Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 11:27
Behavioral task
behavioral1
Sample
25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe
Resource
win7-20240508-en
General
-
Target
25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe
-
Size
235KB
-
MD5
32099bdcf2a8c75821bc048193d3b1f5
-
SHA1
3a28da976bdb4f301dc94afcd0cf2ed60e0c0065
-
SHA256
25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19
-
SHA512
e13e0c78cff7e9603c2cee4c720d5680c3ddbd0a21303dcd67733c06f284f7657cdfd10544e6cab470f4d92129a5e8c98684cb518b204ffcfba439249bcaa18c
-
SSDEEP
6144:TloZM+rIkd8g+EtXHkv/iD4agl0LxCqVYQhTuOLKDb8e1moiLiP:RoZtL+EP8agl0LxCqVYQhTuOLM3J
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2424-1-0x0000000001280000-0x00000000012C0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2800 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe -
Deletes itself 1 IoCs
pid Process 2116 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 7 discord.com 8 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1504 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2292 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 2800 powershell.exe 2680 powershell.exe 2792 powershell.exe 2880 powershell.exe 2584 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe Token: SeIncreaseQuotaPrivilege 2308 wmic.exe Token: SeSecurityPrivilege 2308 wmic.exe Token: SeTakeOwnershipPrivilege 2308 wmic.exe Token: SeLoadDriverPrivilege 2308 wmic.exe Token: SeSystemProfilePrivilege 2308 wmic.exe Token: SeSystemtimePrivilege 2308 wmic.exe Token: SeProfSingleProcessPrivilege 2308 wmic.exe Token: SeIncBasePriorityPrivilege 2308 wmic.exe Token: SeCreatePagefilePrivilege 2308 wmic.exe Token: SeBackupPrivilege 2308 wmic.exe Token: SeRestorePrivilege 2308 wmic.exe Token: SeShutdownPrivilege 2308 wmic.exe Token: SeDebugPrivilege 2308 wmic.exe Token: SeSystemEnvironmentPrivilege 2308 wmic.exe Token: SeRemoteShutdownPrivilege 2308 wmic.exe Token: SeUndockPrivilege 2308 wmic.exe Token: SeManageVolumePrivilege 2308 wmic.exe Token: 33 2308 wmic.exe Token: 34 2308 wmic.exe Token: 35 2308 wmic.exe Token: SeIncreaseQuotaPrivilege 2308 wmic.exe Token: SeSecurityPrivilege 2308 wmic.exe Token: SeTakeOwnershipPrivilege 2308 wmic.exe Token: SeLoadDriverPrivilege 2308 wmic.exe Token: SeSystemProfilePrivilege 2308 wmic.exe Token: SeSystemtimePrivilege 2308 wmic.exe Token: SeProfSingleProcessPrivilege 2308 wmic.exe Token: SeIncBasePriorityPrivilege 2308 wmic.exe Token: SeCreatePagefilePrivilege 2308 wmic.exe Token: SeBackupPrivilege 2308 wmic.exe Token: SeRestorePrivilege 2308 wmic.exe Token: SeShutdownPrivilege 2308 wmic.exe Token: SeDebugPrivilege 2308 wmic.exe Token: SeSystemEnvironmentPrivilege 2308 wmic.exe Token: SeRemoteShutdownPrivilege 2308 wmic.exe Token: SeUndockPrivilege 2308 wmic.exe Token: SeManageVolumePrivilege 2308 wmic.exe Token: 33 2308 wmic.exe Token: 34 2308 wmic.exe Token: 35 2308 wmic.exe Token: SeDebugPrivilege 2800 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeIncreaseQuotaPrivilege 2008 wmic.exe Token: SeSecurityPrivilege 2008 wmic.exe Token: SeTakeOwnershipPrivilege 2008 wmic.exe Token: SeLoadDriverPrivilege 2008 wmic.exe Token: SeSystemProfilePrivilege 2008 wmic.exe Token: SeSystemtimePrivilege 2008 wmic.exe Token: SeProfSingleProcessPrivilege 2008 wmic.exe Token: SeIncBasePriorityPrivilege 2008 wmic.exe Token: SeCreatePagefilePrivilege 2008 wmic.exe Token: SeBackupPrivilege 2008 wmic.exe Token: SeRestorePrivilege 2008 wmic.exe Token: SeShutdownPrivilege 2008 wmic.exe Token: SeDebugPrivilege 2008 wmic.exe Token: SeSystemEnvironmentPrivilege 2008 wmic.exe Token: SeRemoteShutdownPrivilege 2008 wmic.exe Token: SeUndockPrivilege 2008 wmic.exe Token: SeManageVolumePrivilege 2008 wmic.exe Token: 33 2008 wmic.exe Token: 34 2008 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2308 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 28 PID 2424 wrote to memory of 2308 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 28 PID 2424 wrote to memory of 2308 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 28 PID 2424 wrote to memory of 2620 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 31 PID 2424 wrote to memory of 2620 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 31 PID 2424 wrote to memory of 2620 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 31 PID 2424 wrote to memory of 2800 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 33 PID 2424 wrote to memory of 2800 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 33 PID 2424 wrote to memory of 2800 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 33 PID 2424 wrote to memory of 2680 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 35 PID 2424 wrote to memory of 2680 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 35 PID 2424 wrote to memory of 2680 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 35 PID 2424 wrote to memory of 2792 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 37 PID 2424 wrote to memory of 2792 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 37 PID 2424 wrote to memory of 2792 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 37 PID 2424 wrote to memory of 2880 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 39 PID 2424 wrote to memory of 2880 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 39 PID 2424 wrote to memory of 2880 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 39 PID 2424 wrote to memory of 2008 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 41 PID 2424 wrote to memory of 2008 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 41 PID 2424 wrote to memory of 2008 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 41 PID 2424 wrote to memory of 1980 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 43 PID 2424 wrote to memory of 1980 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 43 PID 2424 wrote to memory of 1980 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 43 PID 2424 wrote to memory of 792 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 45 PID 2424 wrote to memory of 792 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 45 PID 2424 wrote to memory of 792 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 45 PID 2424 wrote to memory of 2584 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 47 PID 2424 wrote to memory of 2584 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 47 PID 2424 wrote to memory of 2584 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 47 PID 2424 wrote to memory of 1504 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 49 PID 2424 wrote to memory of 1504 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 49 PID 2424 wrote to memory of 1504 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 49 PID 2424 wrote to memory of 2116 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 51 PID 2424 wrote to memory of 2116 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 51 PID 2424 wrote to memory of 2116 2424 25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe 51 PID 2116 wrote to memory of 2292 2116 cmd.exe 53 PID 2116 wrote to memory of 2292 2116 cmd.exe 53 PID 2116 wrote to memory of 2292 2116 cmd.exe 53 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2620 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe"C:\Users\Admin\AppData\Local\Temp\25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe"2⤵
- Views/modifies file attributes
PID:2620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1980
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1504
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\25c02277f2a8d87c337a7ed145b3aebe37df66811b7fa9f158dfb09af777fd19.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:2292
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5738c2121c5085ad8e6353d173cd3c7b4
SHA1b62afd25081ea6b66301b9787f2351ac6b5c18ff
SHA25613b7c1c50246580020bf8a716e4cf3c7f7ffb510191172939ac5cb47300072f8
SHA5124ea8f49476cd7b716807f737ea0b19394aeeb070b4050ad762de0f72f860e1f0e31c83ac7685a162f2fe9ead263a145e48651080c88ec2c6b44f806b1a9a855d