Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
FIXER-2.3.exe
Resource
win7-20240221-en
General
-
Target
FIXER-2.3.exe
-
Size
678KB
-
MD5
c4a81b5b47dab29d88805f75c95035a0
-
SHA1
092fcb36a736198e19530c96991d9bcb0354fa75
-
SHA256
1ce288b4eace5690b66c6681e77f4f75d1c5fda07eab5a410ffe38271d515909
-
SHA512
eb98f91df470f6f52ad8db2d44da3a090b63d4067e371ca8df1b5e54e7623123d6ba7df779b27cf6298d7778b415e9569f29c62ef6276f8d666134ff4aa7006e
-
SSDEEP
6144:u4zMHU2N3RSUDqnopqonzuv4NIAyxuQiOfFs3OJ18xNz+KgbqUypit:u44RuS78onzuv4NIAAuQkOzu
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/files/0x000500000002328f-4.dat family_umbral behavioral2/memory/4496-13-0x000002E465570000-0x000002E4655B0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4880 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FIXER-2.3.exe -
Executes dropped EXE 1 IoCs
pid Process 4496 Umbral.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2188 wmic.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4496 Umbral.exe 4880 powershell.exe 4880 powershell.exe 2436 powershell.exe 2436 powershell.exe 860 powershell.exe 860 powershell.exe 1484 powershell.exe 1484 powershell.exe 3724 powershell.exe 3724 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4496 Umbral.exe Token: SeIncreaseQuotaPrivilege 2984 wmic.exe Token: SeSecurityPrivilege 2984 wmic.exe Token: SeTakeOwnershipPrivilege 2984 wmic.exe Token: SeLoadDriverPrivilege 2984 wmic.exe Token: SeSystemProfilePrivilege 2984 wmic.exe Token: SeSystemtimePrivilege 2984 wmic.exe Token: SeProfSingleProcessPrivilege 2984 wmic.exe Token: SeIncBasePriorityPrivilege 2984 wmic.exe Token: SeCreatePagefilePrivilege 2984 wmic.exe Token: SeBackupPrivilege 2984 wmic.exe Token: SeRestorePrivilege 2984 wmic.exe Token: SeShutdownPrivilege 2984 wmic.exe Token: SeDebugPrivilege 2984 wmic.exe Token: SeSystemEnvironmentPrivilege 2984 wmic.exe Token: SeRemoteShutdownPrivilege 2984 wmic.exe Token: SeUndockPrivilege 2984 wmic.exe Token: SeManageVolumePrivilege 2984 wmic.exe Token: 33 2984 wmic.exe Token: 34 2984 wmic.exe Token: 35 2984 wmic.exe Token: 36 2984 wmic.exe Token: SeIncreaseQuotaPrivilege 2984 wmic.exe Token: SeSecurityPrivilege 2984 wmic.exe Token: SeTakeOwnershipPrivilege 2984 wmic.exe Token: SeLoadDriverPrivilege 2984 wmic.exe Token: SeSystemProfilePrivilege 2984 wmic.exe Token: SeSystemtimePrivilege 2984 wmic.exe Token: SeProfSingleProcessPrivilege 2984 wmic.exe Token: SeIncBasePriorityPrivilege 2984 wmic.exe Token: SeCreatePagefilePrivilege 2984 wmic.exe Token: SeBackupPrivilege 2984 wmic.exe Token: SeRestorePrivilege 2984 wmic.exe Token: SeShutdownPrivilege 2984 wmic.exe Token: SeDebugPrivilege 2984 wmic.exe Token: SeSystemEnvironmentPrivilege 2984 wmic.exe Token: SeRemoteShutdownPrivilege 2984 wmic.exe Token: SeUndockPrivilege 2984 wmic.exe Token: SeManageVolumePrivilege 2984 wmic.exe Token: 33 2984 wmic.exe Token: 34 2984 wmic.exe Token: 35 2984 wmic.exe Token: 36 2984 wmic.exe Token: SeDebugPrivilege 4880 powershell.exe Token: SeDebugPrivilege 2436 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeDebugPrivilege 1484 powershell.exe Token: SeIncreaseQuotaPrivilege 4024 wmic.exe Token: SeSecurityPrivilege 4024 wmic.exe Token: SeTakeOwnershipPrivilege 4024 wmic.exe Token: SeLoadDriverPrivilege 4024 wmic.exe Token: SeSystemProfilePrivilege 4024 wmic.exe Token: SeSystemtimePrivilege 4024 wmic.exe Token: SeProfSingleProcessPrivilege 4024 wmic.exe Token: SeIncBasePriorityPrivilege 4024 wmic.exe Token: SeCreatePagefilePrivilege 4024 wmic.exe Token: SeBackupPrivilege 4024 wmic.exe Token: SeRestorePrivilege 4024 wmic.exe Token: SeShutdownPrivilege 4024 wmic.exe Token: SeDebugPrivilege 4024 wmic.exe Token: SeSystemEnvironmentPrivilege 4024 wmic.exe Token: SeRemoteShutdownPrivilege 4024 wmic.exe Token: SeUndockPrivilege 4024 wmic.exe Token: SeManageVolumePrivilege 4024 wmic.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2472 wrote to memory of 4496 2472 FIXER-2.3.exe 83 PID 2472 wrote to memory of 4496 2472 FIXER-2.3.exe 83 PID 2472 wrote to memory of 4536 2472 FIXER-2.3.exe 84 PID 2472 wrote to memory of 4536 2472 FIXER-2.3.exe 84 PID 2472 wrote to memory of 4536 2472 FIXER-2.3.exe 84 PID 4496 wrote to memory of 2984 4496 Umbral.exe 86 PID 4496 wrote to memory of 2984 4496 Umbral.exe 86 PID 4496 wrote to memory of 4880 4496 Umbral.exe 89 PID 4496 wrote to memory of 4880 4496 Umbral.exe 89 PID 4496 wrote to memory of 2436 4496 Umbral.exe 91 PID 4496 wrote to memory of 2436 4496 Umbral.exe 91 PID 4496 wrote to memory of 860 4496 Umbral.exe 93 PID 4496 wrote to memory of 860 4496 Umbral.exe 93 PID 4496 wrote to memory of 1484 4496 Umbral.exe 95 PID 4496 wrote to memory of 1484 4496 Umbral.exe 95 PID 4496 wrote to memory of 4024 4496 Umbral.exe 98 PID 4496 wrote to memory of 4024 4496 Umbral.exe 98 PID 4496 wrote to memory of 3512 4496 Umbral.exe 100 PID 4496 wrote to memory of 3512 4496 Umbral.exe 100 PID 4496 wrote to memory of 4392 4496 Umbral.exe 102 PID 4496 wrote to memory of 4392 4496 Umbral.exe 102 PID 4496 wrote to memory of 3724 4496 Umbral.exe 104 PID 4496 wrote to memory of 3724 4496 Umbral.exe 104 PID 4496 wrote to memory of 2188 4496 Umbral.exe 106 PID 4496 wrote to memory of 2188 4496 Umbral.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\FIXER-2.3.exe"C:\Users\Admin\AppData\Local\Temp\FIXER-2.3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:3512
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:4392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2188
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bum.bat" "2⤵PID:4536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
948B
MD574a6b79d36b4aae8b027a218bc6e1af7
SHA10350e46c1df6934903c4820a00b0bc4721779e5f
SHA25660c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
SHA51260e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD56317adf4fbc43ea2fd68861fafd57155
SHA16b87c718893c83c6eed2767e8d9cbc6443e31913
SHA256c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af
SHA51217229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0
-
Filesize
231KB
MD54726eb272b00df9ffd0274d16aa7c8ae
SHA1a3c98c19fd956d61f32e0fe214f855e4ac810904
SHA2567b5df9094a3d6133b309f01585bb2391b4e5e4c7d91737e25399e73053b219ad
SHA512bd8acb0ab507ac015cb213ec5baed52f60b7144c25e5b32828e8406a7a7264a708708a6149e09e80d83664eadda7381a440305e607c6511e101b51da2f2a110b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
442KB
MD512e75cc92bd7f9350f40745437a75e0f
SHA14deead6e14afc6df1afd88e91fd7caa1acf37294
SHA2560f8ebc8ff32f92408a8d383cceb1e1bc2dc0f0dfe1cffbfe808d82303c98f759
SHA512c43fdde607adaea7f2d8949dac5db7143553f8ef498f2801180c7cdcd31353dcd80af42ce65677305432bf8e5a59bf0f728b9cb4a69a14bca0e529342f03070d