Analysis
-
max time kernel
18s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 03:20
Behavioral task
behavioral1
Sample
c045a0feb21965b697ce7c6abcf68d94.exe
Resource
win7-20240704-en
General
-
Target
c045a0feb21965b697ce7c6abcf68d94.exe
-
Size
8.0MB
-
MD5
c045a0feb21965b697ce7c6abcf68d94
-
SHA1
bd60e3aa141a2ed4dbb11313be29fadc9fb50b6a
-
SHA256
2a068fd9cec974e59a74ab132f781f9c69cb5b620e562f05d514d7720752ae64
-
SHA512
013661d73b8140304a8578b9d903e9192aed82ce1dc244065284a5ae5ed83482e23a302dd164243959468bbd2b124e1b892373737f9c95ad85aba699159be20a
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4TNXVBoOJBiPHaIJtM1ub8e1m6i:joZtL+EP8xXVBoOJBiPHaIJtMEA
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2488-1-0x0000000001250000-0x0000000001290000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
c045a0feb21965b697ce7c6abcf68d94.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts c045a0feb21965b697ce7c6abcf68d94.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3008 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
c045a0feb21965b697ce7c6abcf68d94.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2488 c045a0feb21965b697ce7c6abcf68d94.exe 2784 powershell.exe 2948 powershell.exe 700 powershell.exe 2344 powershell.exe 1276 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c045a0feb21965b697ce7c6abcf68d94.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2488 c045a0feb21965b697ce7c6abcf68d94.exe Token: SeIncreaseQuotaPrivilege 2108 wmic.exe Token: SeSecurityPrivilege 2108 wmic.exe Token: SeTakeOwnershipPrivilege 2108 wmic.exe Token: SeLoadDriverPrivilege 2108 wmic.exe Token: SeSystemProfilePrivilege 2108 wmic.exe Token: SeSystemtimePrivilege 2108 wmic.exe Token: SeProfSingleProcessPrivilege 2108 wmic.exe Token: SeIncBasePriorityPrivilege 2108 wmic.exe Token: SeCreatePagefilePrivilege 2108 wmic.exe Token: SeBackupPrivilege 2108 wmic.exe Token: SeRestorePrivilege 2108 wmic.exe Token: SeShutdownPrivilege 2108 wmic.exe Token: SeDebugPrivilege 2108 wmic.exe Token: SeSystemEnvironmentPrivilege 2108 wmic.exe Token: SeRemoteShutdownPrivilege 2108 wmic.exe Token: SeUndockPrivilege 2108 wmic.exe Token: SeManageVolumePrivilege 2108 wmic.exe Token: 33 2108 wmic.exe Token: 34 2108 wmic.exe Token: 35 2108 wmic.exe Token: SeIncreaseQuotaPrivilege 2108 wmic.exe Token: SeSecurityPrivilege 2108 wmic.exe Token: SeTakeOwnershipPrivilege 2108 wmic.exe Token: SeLoadDriverPrivilege 2108 wmic.exe Token: SeSystemProfilePrivilege 2108 wmic.exe Token: SeSystemtimePrivilege 2108 wmic.exe Token: SeProfSingleProcessPrivilege 2108 wmic.exe Token: SeIncBasePriorityPrivilege 2108 wmic.exe Token: SeCreatePagefilePrivilege 2108 wmic.exe Token: SeBackupPrivilege 2108 wmic.exe Token: SeRestorePrivilege 2108 wmic.exe Token: SeShutdownPrivilege 2108 wmic.exe Token: SeDebugPrivilege 2108 wmic.exe Token: SeSystemEnvironmentPrivilege 2108 wmic.exe Token: SeRemoteShutdownPrivilege 2108 wmic.exe Token: SeUndockPrivilege 2108 wmic.exe Token: SeManageVolumePrivilege 2108 wmic.exe Token: 33 2108 wmic.exe Token: 34 2108 wmic.exe Token: 35 2108 wmic.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2948 powershell.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeIncreaseQuotaPrivilege 1920 wmic.exe Token: SeSecurityPrivilege 1920 wmic.exe Token: SeTakeOwnershipPrivilege 1920 wmic.exe Token: SeLoadDriverPrivilege 1920 wmic.exe Token: SeSystemProfilePrivilege 1920 wmic.exe Token: SeSystemtimePrivilege 1920 wmic.exe Token: SeProfSingleProcessPrivilege 1920 wmic.exe Token: SeIncBasePriorityPrivilege 1920 wmic.exe Token: SeCreatePagefilePrivilege 1920 wmic.exe Token: SeBackupPrivilege 1920 wmic.exe Token: SeRestorePrivilege 1920 wmic.exe Token: SeShutdownPrivilege 1920 wmic.exe Token: SeDebugPrivilege 1920 wmic.exe Token: SeSystemEnvironmentPrivilege 1920 wmic.exe Token: SeRemoteShutdownPrivilege 1920 wmic.exe Token: SeUndockPrivilege 1920 wmic.exe Token: SeManageVolumePrivilege 1920 wmic.exe Token: 33 1920 wmic.exe Token: 34 1920 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
c045a0feb21965b697ce7c6abcf68d94.execmd.exedescription pid process target process PID 2488 wrote to memory of 2108 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2108 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2108 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2880 2488 c045a0feb21965b697ce7c6abcf68d94.exe attrib.exe PID 2488 wrote to memory of 2880 2488 c045a0feb21965b697ce7c6abcf68d94.exe attrib.exe PID 2488 wrote to memory of 2880 2488 c045a0feb21965b697ce7c6abcf68d94.exe attrib.exe PID 2488 wrote to memory of 2784 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2784 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2784 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2948 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2948 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2948 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 700 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 700 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 700 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2344 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2344 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2344 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 1920 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 1920 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 1920 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2036 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2036 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2036 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2840 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2840 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2840 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 1276 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 1276 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 1276 2488 c045a0feb21965b697ce7c6abcf68d94.exe powershell.exe PID 2488 wrote to memory of 2672 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2672 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 2672 2488 c045a0feb21965b697ce7c6abcf68d94.exe wmic.exe PID 2488 wrote to memory of 3008 2488 c045a0feb21965b697ce7c6abcf68d94.exe cmd.exe PID 2488 wrote to memory of 3008 2488 c045a0feb21965b697ce7c6abcf68d94.exe cmd.exe PID 2488 wrote to memory of 3008 2488 c045a0feb21965b697ce7c6abcf68d94.exe cmd.exe PID 3008 wrote to memory of 2080 3008 cmd.exe PING.EXE PID 3008 wrote to memory of 2080 3008 cmd.exe PING.EXE PID 3008 wrote to memory of 2080 3008 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c045a0feb21965b697ce7c6abcf68d94.exe"C:\Users\Admin\AppData\Local\Temp\c045a0feb21965b697ce7c6abcf68d94.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\c045a0feb21965b697ce7c6abcf68d94.exe"2⤵
- Views/modifies file attributes
PID:2880 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c045a0feb21965b697ce7c6abcf68d94.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2036
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2840
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2672 -
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\c045a0feb21965b697ce7c6abcf68d94.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD58bea3a5e5b573df48ca478a47e48bff3
SHA1fd60b479380981f9fbddefcf7555c433b8e279fd
SHA256b1fca064f34d6ede2ea5d540bc02e63473813db56e13182f6c80b5d6e78e1018
SHA512dc52fed01922a6d4296aa50b631bf14513550a8f8a3ea9c463f10cd5f701749dfcabe811ad0e0be815fa5b80a45f103a8d1ab687d038b53bf2b7ada2ae29e2b9
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1276-43-0x0000000001F40000-0x0000000001F48000-memory.dmpFilesize
32KB
-
memory/2488-0-0x000007FEF5583000-0x000007FEF5584000-memory.dmpFilesize
4KB
-
memory/2488-1-0x0000000001250000-0x0000000001290000-memory.dmpFilesize
256KB
-
memory/2488-2-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmpFilesize
9.9MB
-
memory/2488-47-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmpFilesize
9.9MB
-
memory/2784-7-0x000000001B2B0000-0x000000001B592000-memory.dmpFilesize
2.9MB
-
memory/2784-8-0x0000000002010000-0x0000000002018000-memory.dmpFilesize
32KB
-
memory/2948-14-0x000000001B390000-0x000000001B672000-memory.dmpFilesize
2.9MB
-
memory/2948-15-0x0000000002370000-0x0000000002378000-memory.dmpFilesize
32KB