Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 00:06
Behavioral task
behavioral1
Sample
LegacyPhasmo/LegacyPhasmo.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
LegacyPhasmo/LegacyPhasmo.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
LegacyPhasmo/start.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
LegacyPhasmo/start.exe
Resource
win10v2004-20240426-en
General
-
Target
LegacyPhasmo/LegacyPhasmo.exe
-
Size
495KB
-
MD5
85946e8adc17bed93bb80005f2caabe7
-
SHA1
b7941993fc3c58a9a42296b82e43f0988feb2ed9
-
SHA256
649683f80b00b62ba0979634a6935088637e8b12f91ef8260dfaafa4840d6555
-
SHA512
331cc3635905ff7673f545c7570cbaae1fa7a7b5637a610d1ce801929d67b527e88cb1e453aa4b1c402ea2565e0e5fa6729d822d38527a6bd8f8e84348c6e51c
-
SSDEEP
6144:vloZM+rIkd8g+EtXHkv/iD42LM3t74sziKrd4UB8Fb8e1mgi04OA:NoZtL+EP82LM3t74sziKrd4UBsa00
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1708-1-0x00000000008A0000-0x0000000000922000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2612 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts LegacyPhasmo.exe -
Deletes itself 1 IoCs
pid Process 1196 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 7 discord.com 8 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 572 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1756 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1708 LegacyPhasmo.exe 2612 powershell.exe 2624 powershell.exe 2540 powershell.exe 2792 powershell.exe 624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1708 LegacyPhasmo.exe Token: SeIncreaseQuotaPrivilege 2580 wmic.exe Token: SeSecurityPrivilege 2580 wmic.exe Token: SeTakeOwnershipPrivilege 2580 wmic.exe Token: SeLoadDriverPrivilege 2580 wmic.exe Token: SeSystemProfilePrivilege 2580 wmic.exe Token: SeSystemtimePrivilege 2580 wmic.exe Token: SeProfSingleProcessPrivilege 2580 wmic.exe Token: SeIncBasePriorityPrivilege 2580 wmic.exe Token: SeCreatePagefilePrivilege 2580 wmic.exe Token: SeBackupPrivilege 2580 wmic.exe Token: SeRestorePrivilege 2580 wmic.exe Token: SeShutdownPrivilege 2580 wmic.exe Token: SeDebugPrivilege 2580 wmic.exe Token: SeSystemEnvironmentPrivilege 2580 wmic.exe Token: SeRemoteShutdownPrivilege 2580 wmic.exe Token: SeUndockPrivilege 2580 wmic.exe Token: SeManageVolumePrivilege 2580 wmic.exe Token: 33 2580 wmic.exe Token: 34 2580 wmic.exe Token: 35 2580 wmic.exe Token: SeIncreaseQuotaPrivilege 2580 wmic.exe Token: SeSecurityPrivilege 2580 wmic.exe Token: SeTakeOwnershipPrivilege 2580 wmic.exe Token: SeLoadDriverPrivilege 2580 wmic.exe Token: SeSystemProfilePrivilege 2580 wmic.exe Token: SeSystemtimePrivilege 2580 wmic.exe Token: SeProfSingleProcessPrivilege 2580 wmic.exe Token: SeIncBasePriorityPrivilege 2580 wmic.exe Token: SeCreatePagefilePrivilege 2580 wmic.exe Token: SeBackupPrivilege 2580 wmic.exe Token: SeRestorePrivilege 2580 wmic.exe Token: SeShutdownPrivilege 2580 wmic.exe Token: SeDebugPrivilege 2580 wmic.exe Token: SeSystemEnvironmentPrivilege 2580 wmic.exe Token: SeRemoteShutdownPrivilege 2580 wmic.exe Token: SeUndockPrivilege 2580 wmic.exe Token: SeManageVolumePrivilege 2580 wmic.exe Token: 33 2580 wmic.exe Token: 34 2580 wmic.exe Token: 35 2580 wmic.exe Token: SeDebugPrivilege 2612 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 2540 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeIncreaseQuotaPrivilege 2384 wmic.exe Token: SeSecurityPrivilege 2384 wmic.exe Token: SeTakeOwnershipPrivilege 2384 wmic.exe Token: SeLoadDriverPrivilege 2384 wmic.exe Token: SeSystemProfilePrivilege 2384 wmic.exe Token: SeSystemtimePrivilege 2384 wmic.exe Token: SeProfSingleProcessPrivilege 2384 wmic.exe Token: SeIncBasePriorityPrivilege 2384 wmic.exe Token: SeCreatePagefilePrivilege 2384 wmic.exe Token: SeBackupPrivilege 2384 wmic.exe Token: SeRestorePrivilege 2384 wmic.exe Token: SeShutdownPrivilege 2384 wmic.exe Token: SeDebugPrivilege 2384 wmic.exe Token: SeSystemEnvironmentPrivilege 2384 wmic.exe Token: SeRemoteShutdownPrivilege 2384 wmic.exe Token: SeUndockPrivilege 2384 wmic.exe Token: SeManageVolumePrivilege 2384 wmic.exe Token: 33 2384 wmic.exe Token: 34 2384 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2580 1708 LegacyPhasmo.exe 28 PID 1708 wrote to memory of 2580 1708 LegacyPhasmo.exe 28 PID 1708 wrote to memory of 2580 1708 LegacyPhasmo.exe 28 PID 1708 wrote to memory of 2688 1708 LegacyPhasmo.exe 31 PID 1708 wrote to memory of 2688 1708 LegacyPhasmo.exe 31 PID 1708 wrote to memory of 2688 1708 LegacyPhasmo.exe 31 PID 1708 wrote to memory of 2612 1708 LegacyPhasmo.exe 33 PID 1708 wrote to memory of 2612 1708 LegacyPhasmo.exe 33 PID 1708 wrote to memory of 2612 1708 LegacyPhasmo.exe 33 PID 1708 wrote to memory of 2624 1708 LegacyPhasmo.exe 35 PID 1708 wrote to memory of 2624 1708 LegacyPhasmo.exe 35 PID 1708 wrote to memory of 2624 1708 LegacyPhasmo.exe 35 PID 1708 wrote to memory of 2540 1708 LegacyPhasmo.exe 37 PID 1708 wrote to memory of 2540 1708 LegacyPhasmo.exe 37 PID 1708 wrote to memory of 2540 1708 LegacyPhasmo.exe 37 PID 1708 wrote to memory of 2792 1708 LegacyPhasmo.exe 39 PID 1708 wrote to memory of 2792 1708 LegacyPhasmo.exe 39 PID 1708 wrote to memory of 2792 1708 LegacyPhasmo.exe 39 PID 1708 wrote to memory of 2384 1708 LegacyPhasmo.exe 41 PID 1708 wrote to memory of 2384 1708 LegacyPhasmo.exe 41 PID 1708 wrote to memory of 2384 1708 LegacyPhasmo.exe 41 PID 1708 wrote to memory of 1628 1708 LegacyPhasmo.exe 43 PID 1708 wrote to memory of 1628 1708 LegacyPhasmo.exe 43 PID 1708 wrote to memory of 1628 1708 LegacyPhasmo.exe 43 PID 1708 wrote to memory of 1588 1708 LegacyPhasmo.exe 45 PID 1708 wrote to memory of 1588 1708 LegacyPhasmo.exe 45 PID 1708 wrote to memory of 1588 1708 LegacyPhasmo.exe 45 PID 1708 wrote to memory of 624 1708 LegacyPhasmo.exe 47 PID 1708 wrote to memory of 624 1708 LegacyPhasmo.exe 47 PID 1708 wrote to memory of 624 1708 LegacyPhasmo.exe 47 PID 1708 wrote to memory of 572 1708 LegacyPhasmo.exe 49 PID 1708 wrote to memory of 572 1708 LegacyPhasmo.exe 49 PID 1708 wrote to memory of 572 1708 LegacyPhasmo.exe 49 PID 1708 wrote to memory of 1196 1708 LegacyPhasmo.exe 51 PID 1708 wrote to memory of 1196 1708 LegacyPhasmo.exe 51 PID 1708 wrote to memory of 1196 1708 LegacyPhasmo.exe 51 PID 1196 wrote to memory of 1756 1196 cmd.exe 53 PID 1196 wrote to memory of 1756 1196 cmd.exe 53 PID 1196 wrote to memory of 1756 1196 cmd.exe 53 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2688 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\LegacyPhasmo.exe"C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\LegacyPhasmo.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\LegacyPhasmo.exe"2⤵
- Views/modifies file attributes
PID:2688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\LegacyPhasmo.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1628
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:624
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:572
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\LegacyPhasmo.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:1756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5717ed8f69f2cc79656a632e3f2eaf301
SHA16ebc7eb2bc9f2099a5343d0039b35266c066e82c
SHA256a142021c1aefefe81d2b1e2031764ae4129f9b8129ef7a3af95d3f89fe53966c
SHA51204d094b9555c6e92ac63c769a8a8dedecb25e3b3e11f84464213b962b812d88575639f7358b7b54f355f13f97f67a82e54e2f4393748bf94537c4d8f9091c88e