Overview
overview
10Static
static
10citrontopp...uh.exe
windows7-x64
10citrontopp...uh.exe
windows10-2004-x64
10citrontopp...uh.exe
windows7-x64
7citrontopp...uh.exe
windows10-2004-x64
9citrontopp...on.exe
windows7-x64
10citrontopp...on.exe
windows10-2004-x64
10citrontopp...on.exe
windows7-x64
10citrontopp...on.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 09:27
Behavioral task
behavioral1
Sample
citrontoppest/citrontoppest/Citronyuh.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
citrontoppest/citrontoppest/Citronyuh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
citrontoppest/citrontoppest/citrontoppest/citronuh.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
citrontoppest/citrontoppest/citrontoppest/citronuh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
citrontoppest/citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
citrontoppest/citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
citrontoppest/citrontoppest/Citronyuh.exe
-
Size
227KB
-
MD5
867db374eb53605b40be55b3c1541e3c
-
SHA1
26999780ea28d4902f2d4350bbbf5dab63591fd5
-
SHA256
ca03916c2b0b804c70ab17755265b3db48fa97480aad3494764f45a1e746bb31
-
SHA512
5210541fc651210c6aae04c78347db84c8e09a4f320e072f390d63fd03587d2764548ca82b41e23631457e852b093e5af3152275b636d55aa58212d6b48e14a0
-
SSDEEP
6144:eloZMLrIkd8g+EtXHkv/iD4emzBywvrYyhkijD6C+b8e1m8i:IoZ0L+EP8emzBywvrYyhkijD6R6
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2500-1-0x00000000011E0000-0x0000000001220000-memory.dmp family_umbral -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2224 powershell.exe 2680 powershell.exe 2864 powershell.exe 2904 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Citronyuh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1748 wmic.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2500 Citronyuh.exe 2224 powershell.exe 2680 powershell.exe 2864 powershell.exe 688 powershell.exe 2904 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2500 Citronyuh.exe Token: SeIncreaseQuotaPrivilege 2364 wmic.exe Token: SeSecurityPrivilege 2364 wmic.exe Token: SeTakeOwnershipPrivilege 2364 wmic.exe Token: SeLoadDriverPrivilege 2364 wmic.exe Token: SeSystemProfilePrivilege 2364 wmic.exe Token: SeSystemtimePrivilege 2364 wmic.exe Token: SeProfSingleProcessPrivilege 2364 wmic.exe Token: SeIncBasePriorityPrivilege 2364 wmic.exe Token: SeCreatePagefilePrivilege 2364 wmic.exe Token: SeBackupPrivilege 2364 wmic.exe Token: SeRestorePrivilege 2364 wmic.exe Token: SeShutdownPrivilege 2364 wmic.exe Token: SeDebugPrivilege 2364 wmic.exe Token: SeSystemEnvironmentPrivilege 2364 wmic.exe Token: SeRemoteShutdownPrivilege 2364 wmic.exe Token: SeUndockPrivilege 2364 wmic.exe Token: SeManageVolumePrivilege 2364 wmic.exe Token: 33 2364 wmic.exe Token: 34 2364 wmic.exe Token: 35 2364 wmic.exe Token: SeIncreaseQuotaPrivilege 2364 wmic.exe Token: SeSecurityPrivilege 2364 wmic.exe Token: SeTakeOwnershipPrivilege 2364 wmic.exe Token: SeLoadDriverPrivilege 2364 wmic.exe Token: SeSystemProfilePrivilege 2364 wmic.exe Token: SeSystemtimePrivilege 2364 wmic.exe Token: SeProfSingleProcessPrivilege 2364 wmic.exe Token: SeIncBasePriorityPrivilege 2364 wmic.exe Token: SeCreatePagefilePrivilege 2364 wmic.exe Token: SeBackupPrivilege 2364 wmic.exe Token: SeRestorePrivilege 2364 wmic.exe Token: SeShutdownPrivilege 2364 wmic.exe Token: SeDebugPrivilege 2364 wmic.exe Token: SeSystemEnvironmentPrivilege 2364 wmic.exe Token: SeRemoteShutdownPrivilege 2364 wmic.exe Token: SeUndockPrivilege 2364 wmic.exe Token: SeManageVolumePrivilege 2364 wmic.exe Token: 33 2364 wmic.exe Token: 34 2364 wmic.exe Token: 35 2364 wmic.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 2864 powershell.exe Token: SeDebugPrivilege 688 powershell.exe Token: SeIncreaseQuotaPrivilege 2884 wmic.exe Token: SeSecurityPrivilege 2884 wmic.exe Token: SeTakeOwnershipPrivilege 2884 wmic.exe Token: SeLoadDriverPrivilege 2884 wmic.exe Token: SeSystemProfilePrivilege 2884 wmic.exe Token: SeSystemtimePrivilege 2884 wmic.exe Token: SeProfSingleProcessPrivilege 2884 wmic.exe Token: SeIncBasePriorityPrivilege 2884 wmic.exe Token: SeCreatePagefilePrivilege 2884 wmic.exe Token: SeBackupPrivilege 2884 wmic.exe Token: SeRestorePrivilege 2884 wmic.exe Token: SeShutdownPrivilege 2884 wmic.exe Token: SeDebugPrivilege 2884 wmic.exe Token: SeSystemEnvironmentPrivilege 2884 wmic.exe Token: SeRemoteShutdownPrivilege 2884 wmic.exe Token: SeUndockPrivilege 2884 wmic.exe Token: SeManageVolumePrivilege 2884 wmic.exe Token: 33 2884 wmic.exe Token: 34 2884 wmic.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2364 2500 Citronyuh.exe 31 PID 2500 wrote to memory of 2364 2500 Citronyuh.exe 31 PID 2500 wrote to memory of 2364 2500 Citronyuh.exe 31 PID 2500 wrote to memory of 2224 2500 Citronyuh.exe 34 PID 2500 wrote to memory of 2224 2500 Citronyuh.exe 34 PID 2500 wrote to memory of 2224 2500 Citronyuh.exe 34 PID 2500 wrote to memory of 2680 2500 Citronyuh.exe 36 PID 2500 wrote to memory of 2680 2500 Citronyuh.exe 36 PID 2500 wrote to memory of 2680 2500 Citronyuh.exe 36 PID 2500 wrote to memory of 2864 2500 Citronyuh.exe 38 PID 2500 wrote to memory of 2864 2500 Citronyuh.exe 38 PID 2500 wrote to memory of 2864 2500 Citronyuh.exe 38 PID 2500 wrote to memory of 688 2500 Citronyuh.exe 40 PID 2500 wrote to memory of 688 2500 Citronyuh.exe 40 PID 2500 wrote to memory of 688 2500 Citronyuh.exe 40 PID 2500 wrote to memory of 2884 2500 Citronyuh.exe 42 PID 2500 wrote to memory of 2884 2500 Citronyuh.exe 42 PID 2500 wrote to memory of 2884 2500 Citronyuh.exe 42 PID 2500 wrote to memory of 1860 2500 Citronyuh.exe 44 PID 2500 wrote to memory of 1860 2500 Citronyuh.exe 44 PID 2500 wrote to memory of 1860 2500 Citronyuh.exe 44 PID 2500 wrote to memory of 1964 2500 Citronyuh.exe 46 PID 2500 wrote to memory of 1964 2500 Citronyuh.exe 46 PID 2500 wrote to memory of 1964 2500 Citronyuh.exe 46 PID 2500 wrote to memory of 2904 2500 Citronyuh.exe 48 PID 2500 wrote to memory of 2904 2500 Citronyuh.exe 48 PID 2500 wrote to memory of 2904 2500 Citronyuh.exe 48 PID 2500 wrote to memory of 1748 2500 Citronyuh.exe 50 PID 2500 wrote to memory of 1748 2500 Citronyuh.exe 50 PID 2500 wrote to memory of 1748 2500 Citronyuh.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\citrontoppest\citrontoppest\Citronyuh.exe"C:\Users\Admin\AppData\Local\Temp\citrontoppest\citrontoppest\Citronyuh.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\citrontoppest\citrontoppest\Citronyuh.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1860
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5de9db398c5acc4c11f008aa1403c0944
SHA11fc3b1cedf15003fa4aecc7c31fe08eac182b9d7
SHA2563bc4474b727e3973e51177eb648d02a55804a8ee8d3e871e3ca36f1b293ebcd2
SHA51268c8b8b74ca8c4c7d975f78da25a6ac694ddc28e996235882a826297843ba3b81dfedc7346b5222f06fb05112857d4eb0430152f4a0f6e05b7fb478ddf4826d2