Analysis
-
max time kernel
70s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-06-2024 17:56
Behavioral task
behavioral1
Sample
Omoforia.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Omoforia.exe
-
Size
216KB
-
MD5
512441160e210a7696cc24bb5b07ebab
-
SHA1
ce8d0012808448dc249b6376a715e16400b7ead4
-
SHA256
319e8877d90fd746f2d47b0f713d1bd594c1b5973b4ffd8e03f881509964db5d
-
SHA512
4a60c13bbdaf63b4dd64706d9278e6a3a4b59c43ec8482fbcdbd1075af355f34ea45e9b57f31718dd8c7f1f9328fa3cbf132e2080dc16a245335fb71c3952146
-
SSDEEP
3072:JmpcjvqySgPAb+D9Cocawot18PeXdJBJg3plgsLSl8eN7s8m+XPcGTSYW:0cWoPAiRrt18aPJei8eNY8mWpS
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1908-1-0x0000000000FF0000-0x000000000102C000-memory.dmp family_umbral -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1652 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 1908 Omoforia.exe Token: SeIncreaseQuotaPrivilege 2564 wmic.exe Token: SeSecurityPrivilege 2564 wmic.exe Token: SeTakeOwnershipPrivilege 2564 wmic.exe Token: SeLoadDriverPrivilege 2564 wmic.exe Token: SeSystemProfilePrivilege 2564 wmic.exe Token: SeSystemtimePrivilege 2564 wmic.exe Token: SeProfSingleProcessPrivilege 2564 wmic.exe Token: SeIncBasePriorityPrivilege 2564 wmic.exe Token: SeCreatePagefilePrivilege 2564 wmic.exe Token: SeBackupPrivilege 2564 wmic.exe Token: SeRestorePrivilege 2564 wmic.exe Token: SeShutdownPrivilege 2564 wmic.exe Token: SeDebugPrivilege 2564 wmic.exe Token: SeSystemEnvironmentPrivilege 2564 wmic.exe Token: SeRemoteShutdownPrivilege 2564 wmic.exe Token: SeUndockPrivilege 2564 wmic.exe Token: SeManageVolumePrivilege 2564 wmic.exe Token: 33 2564 wmic.exe Token: 34 2564 wmic.exe Token: 35 2564 wmic.exe Token: SeIncreaseQuotaPrivilege 2564 wmic.exe Token: SeSecurityPrivilege 2564 wmic.exe Token: SeTakeOwnershipPrivilege 2564 wmic.exe Token: SeLoadDriverPrivilege 2564 wmic.exe Token: SeSystemProfilePrivilege 2564 wmic.exe Token: SeSystemtimePrivilege 2564 wmic.exe Token: SeProfSingleProcessPrivilege 2564 wmic.exe Token: SeIncBasePriorityPrivilege 2564 wmic.exe Token: SeCreatePagefilePrivilege 2564 wmic.exe Token: SeBackupPrivilege 2564 wmic.exe Token: SeRestorePrivilege 2564 wmic.exe Token: SeShutdownPrivilege 2564 wmic.exe Token: SeDebugPrivilege 2564 wmic.exe Token: SeSystemEnvironmentPrivilege 2564 wmic.exe Token: SeRemoteShutdownPrivilege 2564 wmic.exe Token: SeUndockPrivilege 2564 wmic.exe Token: SeManageVolumePrivilege 2564 wmic.exe Token: 33 2564 wmic.exe Token: 34 2564 wmic.exe Token: 35 2564 wmic.exe Token: SeDebugPrivilege 1652 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2564 1908 Omoforia.exe 28 PID 1908 wrote to memory of 2564 1908 Omoforia.exe 28 PID 1908 wrote to memory of 2564 1908 Omoforia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Omoforia.exe"C:\Users\Admin\AppData\Local\Temp\Omoforia.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2552
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1652