Analysis
-
max time kernel
140s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 15:57
Behavioral task
behavioral1
Sample
cheat.exe
Resource
win7-20240221-en
General
-
Target
cheat.exe
-
Size
231KB
-
MD5
8e15d02166ecc355757bd303fe50bc1e
-
SHA1
e527a5f5aea7c84c762cb42b74a420f79ffc20a3
-
SHA256
112eb0863c7d7123d10b7e78262df292b43ab2cc11c81c92e41f64df4d47edae
-
SHA512
63d150761e25a4f6549ac72533be705c1a01643527bf1f4f31fa7dec8b5c49369fe90d64f2fa4fa00e002ad13f6ef45596f0fdc3774058fd994ae1327a71624e
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4bQmmn9GuBi0dP6aPiXb8e1mvDki:joZtL+EP8bQmmn9GuBi0dP6aPkKN
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/1196-1-0x0000013CF0470000-0x0000013CF04B0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1956 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cheat.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 28 discord.com 29 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4620 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4532 PING.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1196 cheat.exe 1196 cheat.exe 1956 powershell.exe 1956 powershell.exe 1956 powershell.exe 4396 powershell.exe 4396 powershell.exe 4396 powershell.exe 3372 powershell.exe 3372 powershell.exe 3372 powershell.exe 2960 powershell.exe 2960 powershell.exe 2960 powershell.exe 5104 powershell.exe 5104 powershell.exe 5104 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1196 cheat.exe Token: SeIncreaseQuotaPrivilege 4700 wmic.exe Token: SeSecurityPrivilege 4700 wmic.exe Token: SeTakeOwnershipPrivilege 4700 wmic.exe Token: SeLoadDriverPrivilege 4700 wmic.exe Token: SeSystemProfilePrivilege 4700 wmic.exe Token: SeSystemtimePrivilege 4700 wmic.exe Token: SeProfSingleProcessPrivilege 4700 wmic.exe Token: SeIncBasePriorityPrivilege 4700 wmic.exe Token: SeCreatePagefilePrivilege 4700 wmic.exe Token: SeBackupPrivilege 4700 wmic.exe Token: SeRestorePrivilege 4700 wmic.exe Token: SeShutdownPrivilege 4700 wmic.exe Token: SeDebugPrivilege 4700 wmic.exe Token: SeSystemEnvironmentPrivilege 4700 wmic.exe Token: SeRemoteShutdownPrivilege 4700 wmic.exe Token: SeUndockPrivilege 4700 wmic.exe Token: SeManageVolumePrivilege 4700 wmic.exe Token: 33 4700 wmic.exe Token: 34 4700 wmic.exe Token: 35 4700 wmic.exe Token: 36 4700 wmic.exe Token: SeIncreaseQuotaPrivilege 4700 wmic.exe Token: SeSecurityPrivilege 4700 wmic.exe Token: SeTakeOwnershipPrivilege 4700 wmic.exe Token: SeLoadDriverPrivilege 4700 wmic.exe Token: SeSystemProfilePrivilege 4700 wmic.exe Token: SeSystemtimePrivilege 4700 wmic.exe Token: SeProfSingleProcessPrivilege 4700 wmic.exe Token: SeIncBasePriorityPrivilege 4700 wmic.exe Token: SeCreatePagefilePrivilege 4700 wmic.exe Token: SeBackupPrivilege 4700 wmic.exe Token: SeRestorePrivilege 4700 wmic.exe Token: SeShutdownPrivilege 4700 wmic.exe Token: SeDebugPrivilege 4700 wmic.exe Token: SeSystemEnvironmentPrivilege 4700 wmic.exe Token: SeRemoteShutdownPrivilege 4700 wmic.exe Token: SeUndockPrivilege 4700 wmic.exe Token: SeManageVolumePrivilege 4700 wmic.exe Token: 33 4700 wmic.exe Token: 34 4700 wmic.exe Token: 35 4700 wmic.exe Token: 36 4700 wmic.exe Token: SeDebugPrivilege 1956 powershell.exe Token: SeDebugPrivilege 4396 powershell.exe Token: SeDebugPrivilege 3372 powershell.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeIncreaseQuotaPrivilege 4056 wmic.exe Token: SeSecurityPrivilege 4056 wmic.exe Token: SeTakeOwnershipPrivilege 4056 wmic.exe Token: SeLoadDriverPrivilege 4056 wmic.exe Token: SeSystemProfilePrivilege 4056 wmic.exe Token: SeSystemtimePrivilege 4056 wmic.exe Token: SeProfSingleProcessPrivilege 4056 wmic.exe Token: SeIncBasePriorityPrivilege 4056 wmic.exe Token: SeCreatePagefilePrivilege 4056 wmic.exe Token: SeBackupPrivilege 4056 wmic.exe Token: SeRestorePrivilege 4056 wmic.exe Token: SeShutdownPrivilege 4056 wmic.exe Token: SeDebugPrivilege 4056 wmic.exe Token: SeSystemEnvironmentPrivilege 4056 wmic.exe Token: SeRemoteShutdownPrivilege 4056 wmic.exe Token: SeUndockPrivilege 4056 wmic.exe Token: SeManageVolumePrivilege 4056 wmic.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1196 wrote to memory of 4700 1196 cheat.exe 93 PID 1196 wrote to memory of 4700 1196 cheat.exe 93 PID 1196 wrote to memory of 1164 1196 cheat.exe 97 PID 1196 wrote to memory of 1164 1196 cheat.exe 97 PID 1196 wrote to memory of 1956 1196 cheat.exe 99 PID 1196 wrote to memory of 1956 1196 cheat.exe 99 PID 1196 wrote to memory of 4396 1196 cheat.exe 101 PID 1196 wrote to memory of 4396 1196 cheat.exe 101 PID 1196 wrote to memory of 3372 1196 cheat.exe 103 PID 1196 wrote to memory of 3372 1196 cheat.exe 103 PID 1196 wrote to memory of 2960 1196 cheat.exe 105 PID 1196 wrote to memory of 2960 1196 cheat.exe 105 PID 1196 wrote to memory of 4056 1196 cheat.exe 107 PID 1196 wrote to memory of 4056 1196 cheat.exe 107 PID 1196 wrote to memory of 3944 1196 cheat.exe 109 PID 1196 wrote to memory of 3944 1196 cheat.exe 109 PID 1196 wrote to memory of 4104 1196 cheat.exe 111 PID 1196 wrote to memory of 4104 1196 cheat.exe 111 PID 1196 wrote to memory of 5104 1196 cheat.exe 113 PID 1196 wrote to memory of 5104 1196 cheat.exe 113 PID 1196 wrote to memory of 4620 1196 cheat.exe 116 PID 1196 wrote to memory of 4620 1196 cheat.exe 116 PID 1196 wrote to memory of 4580 1196 cheat.exe 124 PID 1196 wrote to memory of 4580 1196 cheat.exe 124 PID 4580 wrote to memory of 4532 4580 cmd.exe 126 PID 4580 wrote to memory of 4532 4580 cmd.exe 126 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1164 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\cheat.exe"2⤵
- Views/modifies file attributes
PID:1164
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cheat.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:3944
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:4104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:4620
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\cheat.exe" && pause2⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:4532
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4136,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵PID:3220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
948B
MD5c65738617888921a153bd9b1ef516ee7
SHA15245e71ea3c181d76320c857b639272ac9e079b1
SHA2564640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26
SHA5122e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa
-
Filesize
1KB
MD588be3bc8a7f90e3953298c0fdbec4d72
SHA1f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA5124fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
-
Filesize
1KB
MD5ac057a92f4b62d8880169af0693ef5b2
SHA166e7c7834c5dae5cec863ccd69403150d05841f4
SHA2567cef55990e8e6cfe07e1965b303e79ac562cdc128ab82edf480d9873f72bb3ed
SHA512d525f47da9e61fc87e55aca6b34e776be3ed081b719bbbb5256705a6afe5fdd4c16d5ee595af13994e2718f789f5fd32830331347d97b029c031c9dfe30c7f49
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82