Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 10:03
Behavioral task
behavioral1
Sample
RagdollEngines.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
RagdollEngines.exe
-
Size
229KB
-
MD5
200c41d8aed55fb8062af370c6baa50c
-
SHA1
910bfcccb5411675f5bdbe58166c36b51cfb00d6
-
SHA256
aa674c3b1a3b9ac2b03dbbfa6d862a18aabb1d8b7886d984e84b5470fb1871f8
-
SHA512
a6a8f2f361ef056daf2c91c95ed99724369f096841bf2b4d4be615da5a0fcd9b5f2950e5e6adcdb8c1a387ddbdc31bc102962e2f743f31aa0b61cd2eafcd3de0
-
SSDEEP
6144:dloZM+rIkd8g+EtXHkv/iD4SuiRz2U7X8VtoGnnGMRb8e1m3Nlxi:/oZtL+EP8SuiRz2U7X8VtoGnnGU/
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2148-1-0x0000000000F30000-0x0000000000F70000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2148 RagdollEngines.exe Token: SeIncreaseQuotaPrivilege 3044 wmic.exe Token: SeSecurityPrivilege 3044 wmic.exe Token: SeTakeOwnershipPrivilege 3044 wmic.exe Token: SeLoadDriverPrivilege 3044 wmic.exe Token: SeSystemProfilePrivilege 3044 wmic.exe Token: SeSystemtimePrivilege 3044 wmic.exe Token: SeProfSingleProcessPrivilege 3044 wmic.exe Token: SeIncBasePriorityPrivilege 3044 wmic.exe Token: SeCreatePagefilePrivilege 3044 wmic.exe Token: SeBackupPrivilege 3044 wmic.exe Token: SeRestorePrivilege 3044 wmic.exe Token: SeShutdownPrivilege 3044 wmic.exe Token: SeDebugPrivilege 3044 wmic.exe Token: SeSystemEnvironmentPrivilege 3044 wmic.exe Token: SeRemoteShutdownPrivilege 3044 wmic.exe Token: SeUndockPrivilege 3044 wmic.exe Token: SeManageVolumePrivilege 3044 wmic.exe Token: 33 3044 wmic.exe Token: 34 3044 wmic.exe Token: 35 3044 wmic.exe Token: SeIncreaseQuotaPrivilege 3044 wmic.exe Token: SeSecurityPrivilege 3044 wmic.exe Token: SeTakeOwnershipPrivilege 3044 wmic.exe Token: SeLoadDriverPrivilege 3044 wmic.exe Token: SeSystemProfilePrivilege 3044 wmic.exe Token: SeSystemtimePrivilege 3044 wmic.exe Token: SeProfSingleProcessPrivilege 3044 wmic.exe Token: SeIncBasePriorityPrivilege 3044 wmic.exe Token: SeCreatePagefilePrivilege 3044 wmic.exe Token: SeBackupPrivilege 3044 wmic.exe Token: SeRestorePrivilege 3044 wmic.exe Token: SeShutdownPrivilege 3044 wmic.exe Token: SeDebugPrivilege 3044 wmic.exe Token: SeSystemEnvironmentPrivilege 3044 wmic.exe Token: SeRemoteShutdownPrivilege 3044 wmic.exe Token: SeUndockPrivilege 3044 wmic.exe Token: SeManageVolumePrivilege 3044 wmic.exe Token: 33 3044 wmic.exe Token: 34 3044 wmic.exe Token: 35 3044 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2148 wrote to memory of 3044 2148 RagdollEngines.exe 28 PID 2148 wrote to memory of 3044 2148 RagdollEngines.exe 28 PID 2148 wrote to memory of 3044 2148 RagdollEngines.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\RagdollEngines.exe"C:\Users\Admin\AppData\Local\Temp\RagdollEngines.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044
-