Analysis

  • max time kernel
    133s
  • max time network
    134s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-06-2024 16:18

General

  • Target

    FIXER-2.3.exe

  • Size

    678KB

  • MD5

    c4a81b5b47dab29d88805f75c95035a0

  • SHA1

    092fcb36a736198e19530c96991d9bcb0354fa75

  • SHA256

    1ce288b4eace5690b66c6681e77f4f75d1c5fda07eab5a410ffe38271d515909

  • SHA512

    eb98f91df470f6f52ad8db2d44da3a090b63d4067e371ca8df1b5e54e7623123d6ba7df779b27cf6298d7778b415e9569f29c62ef6276f8d666134ff4aa7006e

  • SSDEEP

    6144:u4zMHU2N3RSUDqnopqonzuv4NIAyxuQiOfFs3OJ18xNz+KgbqUypit:u44RuS78onzuv4NIAAuQkOzu

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discordapp.com/api/webhooks/1247657758921330688/6inL47rtBda5FWXQ9j3KkuojoQUQIHytZMOftRLQPHv1vmGRuP44zUd_P2lo-8gb3cBC

Signatures

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FIXER-2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\FIXER-2.3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2228
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bum.bat" "
      2⤵
        PID:2132

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe

      Filesize

      231KB

      MD5

      4726eb272b00df9ffd0274d16aa7c8ae

      SHA1

      a3c98c19fd956d61f32e0fe214f855e4ac810904

      SHA256

      7b5df9094a3d6133b309f01585bb2391b4e5e4c7d91737e25399e73053b219ad

      SHA512

      bd8acb0ab507ac015cb213ec5baed52f60b7144c25e5b32828e8406a7a7264a708708a6149e09e80d83664eadda7381a440305e607c6511e101b51da2f2a110b

    • C:\Users\Admin\AppData\Local\Temp\bum.bat

      Filesize

      442KB

      MD5

      12e75cc92bd7f9350f40745437a75e0f

      SHA1

      4deead6e14afc6df1afd88e91fd7caa1acf37294

      SHA256

      0f8ebc8ff32f92408a8d383cceb1e1bc2dc0f0dfe1cffbfe808d82303c98f759

      SHA512

      c43fdde607adaea7f2d8949dac5db7143553f8ef498f2801180c7cdcd31353dcd80af42ce65677305432bf8e5a59bf0f728b9cb4a69a14bca0e529342f03070d

    • memory/3040-8-0x000001D7EBBC0000-0x000001D7EBC00000-memory.dmp

      Filesize

      256KB

    • memory/3040-9-0x00007FFFE8123000-0x00007FFFE8124000-memory.dmp

      Filesize

      4KB

    • memory/3040-11-0x00007FFFE8120000-0x00007FFFE8B0C000-memory.dmp

      Filesize

      9.9MB

    • memory/3040-13-0x00007FFFE8120000-0x00007FFFE8B0C000-memory.dmp

      Filesize

      9.9MB