Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 15:57
Behavioral task
behavioral1
Sample
cheat.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
cheat.exe
-
Size
231KB
-
MD5
8e15d02166ecc355757bd303fe50bc1e
-
SHA1
e527a5f5aea7c84c762cb42b74a420f79ffc20a3
-
SHA256
112eb0863c7d7123d10b7e78262df292b43ab2cc11c81c92e41f64df4d47edae
-
SHA512
63d150761e25a4f6549ac72533be705c1a01643527bf1f4f31fa7dec8b5c49369fe90d64f2fa4fa00e002ad13f6ef45596f0fdc3774058fd994ae1327a71624e
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4bQmmn9GuBi0dP6aPiXb8e1mvDki:joZtL+EP8bQmmn9GuBi0dP6aPkKN
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3020-1-0x0000000000220000-0x0000000000260000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3020 cheat.exe Token: SeIncreaseQuotaPrivilege 2128 wmic.exe Token: SeSecurityPrivilege 2128 wmic.exe Token: SeTakeOwnershipPrivilege 2128 wmic.exe Token: SeLoadDriverPrivilege 2128 wmic.exe Token: SeSystemProfilePrivilege 2128 wmic.exe Token: SeSystemtimePrivilege 2128 wmic.exe Token: SeProfSingleProcessPrivilege 2128 wmic.exe Token: SeIncBasePriorityPrivilege 2128 wmic.exe Token: SeCreatePagefilePrivilege 2128 wmic.exe Token: SeBackupPrivilege 2128 wmic.exe Token: SeRestorePrivilege 2128 wmic.exe Token: SeShutdownPrivilege 2128 wmic.exe Token: SeDebugPrivilege 2128 wmic.exe Token: SeSystemEnvironmentPrivilege 2128 wmic.exe Token: SeRemoteShutdownPrivilege 2128 wmic.exe Token: SeUndockPrivilege 2128 wmic.exe Token: SeManageVolumePrivilege 2128 wmic.exe Token: 33 2128 wmic.exe Token: 34 2128 wmic.exe Token: 35 2128 wmic.exe Token: SeIncreaseQuotaPrivilege 2128 wmic.exe Token: SeSecurityPrivilege 2128 wmic.exe Token: SeTakeOwnershipPrivilege 2128 wmic.exe Token: SeLoadDriverPrivilege 2128 wmic.exe Token: SeSystemProfilePrivilege 2128 wmic.exe Token: SeSystemtimePrivilege 2128 wmic.exe Token: SeProfSingleProcessPrivilege 2128 wmic.exe Token: SeIncBasePriorityPrivilege 2128 wmic.exe Token: SeCreatePagefilePrivilege 2128 wmic.exe Token: SeBackupPrivilege 2128 wmic.exe Token: SeRestorePrivilege 2128 wmic.exe Token: SeShutdownPrivilege 2128 wmic.exe Token: SeDebugPrivilege 2128 wmic.exe Token: SeSystemEnvironmentPrivilege 2128 wmic.exe Token: SeRemoteShutdownPrivilege 2128 wmic.exe Token: SeUndockPrivilege 2128 wmic.exe Token: SeManageVolumePrivilege 2128 wmic.exe Token: 33 2128 wmic.exe Token: 34 2128 wmic.exe Token: 35 2128 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2128 3020 cheat.exe 28 PID 3020 wrote to memory of 2128 3020 cheat.exe 28 PID 3020 wrote to memory of 2128 3020 cheat.exe 28