Analysis
-
max time kernel
132s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-06-2024 16:44
Behavioral task
behavioral1
Sample
Loader(1).exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader(1).exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Loader(1).exe
-
Size
495KB
-
MD5
6c200e0e8ddc021a16094bd07c17b1b6
-
SHA1
faa1dba99441d84898171d9ec2962955235183e9
-
SHA256
837e540ab292132a621130757c1d5f1738f83e44568847e9278472eac3dc3046
-
SHA512
bd5e8d976dbdad7d8f5511d777a0998f3d831054b7d3dad2d0a9969ddd622a519b63c1b06b677fef16c90f9ed9de226b25be6ca5f11752a053d6669ce726a15f
-
SSDEEP
12288:doZ1tlRk83MlgvNh0ad1+F7mEl5Qw5nTiii/Izoqs2PiixJ:G5r39Nh0ad1+F7mEl5QwFzoqs2
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/500-1-0x000001714C9B0000-0x000001714CA32000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 500 Loader(1).exe Token: SeIncreaseQuotaPrivilege 3616 wmic.exe Token: SeSecurityPrivilege 3616 wmic.exe Token: SeTakeOwnershipPrivilege 3616 wmic.exe Token: SeLoadDriverPrivilege 3616 wmic.exe Token: SeSystemProfilePrivilege 3616 wmic.exe Token: SeSystemtimePrivilege 3616 wmic.exe Token: SeProfSingleProcessPrivilege 3616 wmic.exe Token: SeIncBasePriorityPrivilege 3616 wmic.exe Token: SeCreatePagefilePrivilege 3616 wmic.exe Token: SeBackupPrivilege 3616 wmic.exe Token: SeRestorePrivilege 3616 wmic.exe Token: SeShutdownPrivilege 3616 wmic.exe Token: SeDebugPrivilege 3616 wmic.exe Token: SeSystemEnvironmentPrivilege 3616 wmic.exe Token: SeRemoteShutdownPrivilege 3616 wmic.exe Token: SeUndockPrivilege 3616 wmic.exe Token: SeManageVolumePrivilege 3616 wmic.exe Token: 33 3616 wmic.exe Token: 34 3616 wmic.exe Token: 35 3616 wmic.exe Token: 36 3616 wmic.exe Token: SeIncreaseQuotaPrivilege 3616 wmic.exe Token: SeSecurityPrivilege 3616 wmic.exe Token: SeTakeOwnershipPrivilege 3616 wmic.exe Token: SeLoadDriverPrivilege 3616 wmic.exe Token: SeSystemProfilePrivilege 3616 wmic.exe Token: SeSystemtimePrivilege 3616 wmic.exe Token: SeProfSingleProcessPrivilege 3616 wmic.exe Token: SeIncBasePriorityPrivilege 3616 wmic.exe Token: SeCreatePagefilePrivilege 3616 wmic.exe Token: SeBackupPrivilege 3616 wmic.exe Token: SeRestorePrivilege 3616 wmic.exe Token: SeShutdownPrivilege 3616 wmic.exe Token: SeDebugPrivilege 3616 wmic.exe Token: SeSystemEnvironmentPrivilege 3616 wmic.exe Token: SeRemoteShutdownPrivilege 3616 wmic.exe Token: SeUndockPrivilege 3616 wmic.exe Token: SeManageVolumePrivilege 3616 wmic.exe Token: 33 3616 wmic.exe Token: 34 3616 wmic.exe Token: 35 3616 wmic.exe Token: 36 3616 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 500 wrote to memory of 3616 500 Loader(1).exe 75 PID 500 wrote to memory of 3616 500 Loader(1).exe 75