Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
07/05/2024, 01:08
Behavioral task
behavioral1
Sample
celex/celex.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
celex/celex.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
celex/celex.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
- Target celex/celex.exe
- Size 232KB
- Sample240507-bg8xvsbe7x
- SHA256 9c6a028c15964ab83a35637a55e9738eec342d67f16c7c0d347b31f259e28629
- MD5 c1e78a3d9c64ee73677e72545163c126
- SHA1 28a33f173005ec78dc14c67d5b5761f4405243be
- SHA512 a8e666fd43d72801db460ecced8ae5217442919b9b1b50b0efdaa5db1b3950dab5d20e6b6567d3463c0808b1b73d6bd40310a6e637a3b8de66b677bcb9ad01ad
- SSDEEP 6144:rloZMLrIkd8g+EtXHkv/iD4ThFphv0IHg2PxM4dy+b8e1magci:poZ0L+EP8ThFphv0IHg2PxM4dpu1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral3/memory/2088-1-0x00000000010B0000-0x00000000010F0000-memory.dmp family_umbral - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2088 celex.exe Token: SeIncreaseQuotaPrivilege 2140 wmic.exe Token: SeSecurityPrivilege 2140 wmic.exe Token: SeTakeOwnershipPrivilege 2140 wmic.exe Token: SeLoadDriverPrivilege 2140 wmic.exe Token: SeSystemProfilePrivilege 2140 wmic.exe Token: SeSystemtimePrivilege 2140 wmic.exe Token: SeProfSingleProcessPrivilege 2140 wmic.exe Token: SeIncBasePriorityPrivilege 2140 wmic.exe Token: SeCreatePagefilePrivilege 2140 wmic.exe Token: SeBackupPrivilege 2140 wmic.exe Token: SeRestorePrivilege 2140 wmic.exe Token: SeShutdownPrivilege 2140 wmic.exe Token: SeDebugPrivilege 2140 wmic.exe Token: SeSystemEnvironmentPrivilege 2140 wmic.exe Token: SeRemoteShutdownPrivilege 2140 wmic.exe Token: SeUndockPrivilege 2140 wmic.exe Token: SeManageVolumePrivilege 2140 wmic.exe Token: 33 2140 wmic.exe Token: 34 2140 wmic.exe Token: 35 2140 wmic.exe Token: SeIncreaseQuotaPrivilege 2140 wmic.exe Token: SeSecurityPrivilege 2140 wmic.exe Token: SeTakeOwnershipPrivilege 2140 wmic.exe Token: SeLoadDriverPrivilege 2140 wmic.exe Token: SeSystemProfilePrivilege 2140 wmic.exe Token: SeSystemtimePrivilege 2140 wmic.exe Token: SeProfSingleProcessPrivilege 2140 wmic.exe Token: SeIncBasePriorityPrivilege 2140 wmic.exe Token: SeCreatePagefilePrivilege 2140 wmic.exe Token: SeBackupPrivilege 2140 wmic.exe Token: SeRestorePrivilege 2140 wmic.exe Token: SeShutdownPrivilege 2140 wmic.exe Token: SeDebugPrivilege 2140 wmic.exe Token: SeSystemEnvironmentPrivilege 2140 wmic.exe Token: SeRemoteShutdownPrivilege 2140 wmic.exe Token: SeUndockPrivilege 2140 wmic.exe Token: SeManageVolumePrivilege 2140 wmic.exe Token: 33 2140 wmic.exe Token: 34 2140 wmic.exe Token: 35 2140 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2140 2088 celex.exe 28 PID 2088 wrote to memory of 2140 2088 celex.exe 28 PID 2088 wrote to memory of 2140 2088 celex.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\celex\celex.exe"C:\Users\Admin\AppData\Local\Temp\celex\celex.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140
-