Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2024 01:22

General

  • Target

    loader.exe

  • Size

    365KB

  • MD5

    cbd720ad4f7be1c099ec22f56ee61dd6

  • SHA1

    9989030c7ea1756e1834c464688d418e773919fc

  • SHA256

    20be105c4a33ebf77ef4db7e8b6ebbb39b156fe1dd16473a7255903f33b76846

  • SHA512

    2ad87fdf5046be22eec58fe71326ab0bcc2a2ca019e1b5519ec1ecbdfbb83731a254c7f400ca48cacb9917da6c85d41a913aa0f8f5b21408a3f2d1e8895e9740

  • SSDEEP

    6144:UsLqdufVUNDa4loZM3fsXtioRkts/cnnK6cMlibJksyVtGXTOMdRYspb8e1m+Fii:PFUNDamoZ1tlRk83MlibJksyVtGXTOMX

Malware Config

Extracted

Family

umbral

C2

https://discordapp.com/api/webhooks/1246463015998586960/d4v_qESsKe8s7VticwxHvyytkOUO321t7x3oNxoyCNYQuwczEVfPUDFWHLnPpAM4tNJ_

Signatures

  • Detect Umbral payload 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5416
    • \??\c:\users\admin\appdata\local\temp\loader.exe 
      c:\users\admin\appdata\local\temp\loader.exe 
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
      • C:\Windows\SYSTEM32\attrib.exe
        "attrib.exe" +h +s "c:\users\admin\appdata\local\temp\loader.exe "
        3⤵
        • Views/modifies file attributes
        PID:1552
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader.exe '
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5480
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2228
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6128
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4420
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:3096
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:2020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
              PID:6088
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_VideoController get name
              3⤵
              • Detects videocard installed
              PID:1280
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c ping localhost && del /F /A h "c:\users\admin\appdata\local\temp\loader.exe " && pause
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5704
              • C:\Windows\system32\PING.EXE
                ping localhost
                4⤵
                • Runs ping.exe
                PID:4128
          • C:\Windows\Resources\Themes\icsys.icn.exe
            C:\Windows\Resources\Themes\icsys.icn.exe
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2948
            • \??\c:\windows\resources\themes\explorer.exe
              c:\windows\resources\themes\explorer.exe
              3⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:812
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe SE
                4⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3452
                • \??\c:\windows\resources\svchost.exe
                  c:\windows\resources\svchost.exe
                  5⤵
                  • Modifies visiblity of hidden/system files in Explorer
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:720
                  • \??\c:\windows\resources\spoolsv.exe
                    c:\windows\resources\spoolsv.exe PR
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:636

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          ec79fae4e7c09310ebf4f2d85a33a638

          SHA1

          f2bdd995b12e65e7ed437d228f22223b59e76efb

          SHA256

          e9c4723a5fe34e081c3d2f548a1d472394cc7aa58056fcf44ca542061381243a

          SHA512

          af9dda12f6bb388d826fe03a4a8beed9bda23a978aa55a2af6a43271660ee896a7ee3bcf2c4d2f1e6180902791d8c23560f1c2ec097a501d8c6f4f6c49075625

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          77d622bb1a5b250869a3238b9bc1402b

          SHA1

          d47f4003c2554b9dfc4c16f22460b331886b191b

          SHA256

          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

          SHA512

          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          74a6b79d36b4aae8b027a218bc6e1af7

          SHA1

          0350e46c1df6934903c4820a00b0bc4721779e5f

          SHA256

          60c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04

          SHA512

          60e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          d3235ed022a42ec4338123ab87144afa

          SHA1

          5058608bc0deb720a585a2304a8f7cf63a50a315

          SHA256

          10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

          SHA512

          236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jkeqwq2j.vq2.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\loader.exe 

          Filesize

          230KB

          MD5

          d23ca81d16873706f5e26fbac64eaee9

          SHA1

          c49585cbcc6e5286fba1c7a3fe582ea0e38ed5ee

          SHA256

          007ae5e7086ce92765cb6f3877663b04146f14deba2edb9582d90d4451b443d7

          SHA512

          4a7d4be3f7a1e27e9c925b57a5e53754f8f39ebabf479e041f620ef5271a7154fe57a407ff59f859f02f149bb60925e2f4e2c9c49f415fd42e780c7ea23922d4

        • C:\Windows\Resources\Themes\explorer.exe

          Filesize

          135KB

          MD5

          d377b6f45a89dfb7ed0005d20b0bf605

          SHA1

          da762173776841df1492b58025af1b942100c4a3

          SHA256

          3ea73c56a759a6f413e0388731c32b062a923e0190bb06427a4b0b5038651330

          SHA512

          5cd262e84eedcfafc47b303e91fda71c925c4dfd5b3c8929681674c4faa24352c6d85862a9d010cf713211353f00eff3919ef4ee57b65008e4b0d58c8d5b538b

        • C:\Windows\Resources\Themes\icsys.icn.exe

          Filesize

          135KB

          MD5

          b6c6d532091f6de047c1a68a4b69bf10

          SHA1

          01439b14f2158014ef0255092f4c11a136483889

          SHA256

          39931e1f612c4cc3ddef588ce4a1d1c1543e85cf16959eb738ed39eb0b2b1a11

          SHA512

          b652116e7a2ebe98cb8e43d024542fdb5c8daccf85dde4c00738eedd55d7a1195155ed4b4ea26fd8e91ce1bbef54c9cd224cd4606b2028168e82c0c2de45798d

        • C:\Windows\Resources\spoolsv.exe

          Filesize

          135KB

          MD5

          e9bb20cadfac2ddd93f3caf0ba97785e

          SHA1

          cb645f2ed9a7c839131bc8cb198b7200587a2cff

          SHA256

          e7e991d5df0fb22d7f77de08e992eb53f928448c623000c1396424353284a514

          SHA512

          fc306ca53fbb3cf7bb34c35c648ea6c3765da94b2ff3e680df4827c3a128bf193fbe60c92dfeec61d9065e65d7efd5f1ec23631a66e886446660258ddc9c6a50

        • C:\Windows\Resources\svchost.exe

          Filesize

          135KB

          MD5

          80f34f44035d5aac87b462e8be0fbe28

          SHA1

          80339682358025cc938e47969972325ab7b6723d

          SHA256

          d88c6fdd9dab15ba2b1ed735355c3b8c3aeb6d0b41bb2424179308d1a0a18412

          SHA512

          089c5be7f4c8ef04cabdd85932cc0d5d4286d20f7cfff59c3d7e9b94b6e8bfe3d5acbe1408a96c60d3babc065db251e5d859a5699b1fb63fce41492efe9d73c4

        • memory/636-115-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/636-111-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2200-11-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

          Filesize

          10.8MB

        • memory/2200-40-0x000002C7EB270000-0x000002C7EB28E000-memory.dmp

          Filesize

          120KB

        • memory/2200-83-0x000002C7EB2B0000-0x000002C7EB2C2000-memory.dmp

          Filesize

          72KB

        • memory/2200-82-0x000002C7EB250000-0x000002C7EB25A000-memory.dmp

          Filesize

          40KB

        • memory/2200-9-0x000002C7E8B80000-0x000002C7E8BC0000-memory.dmp

          Filesize

          256KB

        • memory/2200-38-0x000002C7EB2D0000-0x000002C7EB346000-memory.dmp

          Filesize

          472KB

        • memory/2200-135-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

          Filesize

          10.8MB

        • memory/2200-134-0x000002C7EB3F0000-0x000002C7EB599000-memory.dmp

          Filesize

          1.7MB

        • memory/2200-39-0x000002C7EB350000-0x000002C7EB3A0000-memory.dmp

          Filesize

          320KB

        • memory/2200-10-0x00007FF990903000-0x00007FF990905000-memory.dmp

          Filesize

          8KB

        • memory/2948-117-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/3452-116-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/5416-118-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/5416-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/5480-17-0x000001A020070000-0x000001A020092000-memory.dmp

          Filesize

          136KB