Overview
overview
10Static
static
10citrontopp...uh.exe
windows7-x64
10citrontopp...uh.exe
windows10-2004-x64
10citrontopp...uh.exe
windows7-x64
7citrontopp...uh.exe
windows10-2004-x64
9citrontopp...on.exe
windows7-x64
10citrontopp...on.exe
windows10-2004-x64
10citrontopp...on.exe
windows7-x64
10citrontopp...on.exe
windows10-2004-x64
10Analysis
-
max time kernel
17s -
max time network
23s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 09:27
Behavioral task
behavioral1
Sample
citrontoppest/citrontoppest/Citronyuh.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
citrontoppest/citrontoppest/Citronyuh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
citrontoppest/citrontoppest/citrontoppest/citronuh.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
citrontoppest/citrontoppest/citrontoppest/citronuh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
citrontoppest/citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
citrontoppest/citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
citrontoppest/citrontoppest/updatechecker/updatecheckercitron.exe
-
Size
227KB
-
MD5
a6db1722b4ed09cd06fbdf6f80df47da
-
SHA1
1fe86fceb4884cb37c4187591ccecd7a4c4d9c15
-
SHA256
ed1deb13b32c20b6cd35d50351c78d3729315dac5da6f5795dae2c14bed8520b
-
SHA512
61542031f6f60fca814400c9ec21c0eefa15422646c30b5b3192231a4d5a5845681f7d619818fa0c7c448f860101790d7971c80aa90637e58956b33023079785
-
SSDEEP
6144:+loZMLrIkd8g+EtXHkv/iD4cYiL+cCFdWQj+ctBIpHb8e1mUi:ooZ0L+EP8cYiL+cCFdWQj+ctBIhK
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral7/memory/2240-1-0x0000000000DE0000-0x0000000000E20000-memory.dmp family_umbral -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
pid Process 2608 powershell.exe 2896 powershell.exe 436 powershell.exe 2880 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts updatecheckercitron.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2232 wmic.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2240 updatecheckercitron.exe 2880 powershell.exe 2608 powershell.exe 2896 powershell.exe 1568 powershell.exe 436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2240 updatecheckercitron.exe Token: SeIncreaseQuotaPrivilege 2816 wmic.exe Token: SeSecurityPrivilege 2816 wmic.exe Token: SeTakeOwnershipPrivilege 2816 wmic.exe Token: SeLoadDriverPrivilege 2816 wmic.exe Token: SeSystemProfilePrivilege 2816 wmic.exe Token: SeSystemtimePrivilege 2816 wmic.exe Token: SeProfSingleProcessPrivilege 2816 wmic.exe Token: SeIncBasePriorityPrivilege 2816 wmic.exe Token: SeCreatePagefilePrivilege 2816 wmic.exe Token: SeBackupPrivilege 2816 wmic.exe Token: SeRestorePrivilege 2816 wmic.exe Token: SeShutdownPrivilege 2816 wmic.exe Token: SeDebugPrivilege 2816 wmic.exe Token: SeSystemEnvironmentPrivilege 2816 wmic.exe Token: SeRemoteShutdownPrivilege 2816 wmic.exe Token: SeUndockPrivilege 2816 wmic.exe Token: SeManageVolumePrivilege 2816 wmic.exe Token: 33 2816 wmic.exe Token: 34 2816 wmic.exe Token: 35 2816 wmic.exe Token: SeIncreaseQuotaPrivilege 2816 wmic.exe Token: SeSecurityPrivilege 2816 wmic.exe Token: SeTakeOwnershipPrivilege 2816 wmic.exe Token: SeLoadDriverPrivilege 2816 wmic.exe Token: SeSystemProfilePrivilege 2816 wmic.exe Token: SeSystemtimePrivilege 2816 wmic.exe Token: SeProfSingleProcessPrivilege 2816 wmic.exe Token: SeIncBasePriorityPrivilege 2816 wmic.exe Token: SeCreatePagefilePrivilege 2816 wmic.exe Token: SeBackupPrivilege 2816 wmic.exe Token: SeRestorePrivilege 2816 wmic.exe Token: SeShutdownPrivilege 2816 wmic.exe Token: SeDebugPrivilege 2816 wmic.exe Token: SeSystemEnvironmentPrivilege 2816 wmic.exe Token: SeRemoteShutdownPrivilege 2816 wmic.exe Token: SeUndockPrivilege 2816 wmic.exe Token: SeManageVolumePrivilege 2816 wmic.exe Token: 33 2816 wmic.exe Token: 34 2816 wmic.exe Token: 35 2816 wmic.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 2896 powershell.exe Token: SeDebugPrivilege 1568 powershell.exe Token: SeIncreaseQuotaPrivilege 2960 wmic.exe Token: SeSecurityPrivilege 2960 wmic.exe Token: SeTakeOwnershipPrivilege 2960 wmic.exe Token: SeLoadDriverPrivilege 2960 wmic.exe Token: SeSystemProfilePrivilege 2960 wmic.exe Token: SeSystemtimePrivilege 2960 wmic.exe Token: SeProfSingleProcessPrivilege 2960 wmic.exe Token: SeIncBasePriorityPrivilege 2960 wmic.exe Token: SeCreatePagefilePrivilege 2960 wmic.exe Token: SeBackupPrivilege 2960 wmic.exe Token: SeRestorePrivilege 2960 wmic.exe Token: SeShutdownPrivilege 2960 wmic.exe Token: SeDebugPrivilege 2960 wmic.exe Token: SeSystemEnvironmentPrivilege 2960 wmic.exe Token: SeRemoteShutdownPrivilege 2960 wmic.exe Token: SeUndockPrivilege 2960 wmic.exe Token: SeManageVolumePrivilege 2960 wmic.exe Token: 33 2960 wmic.exe Token: 34 2960 wmic.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2816 2240 updatecheckercitron.exe 29 PID 2240 wrote to memory of 2816 2240 updatecheckercitron.exe 29 PID 2240 wrote to memory of 2816 2240 updatecheckercitron.exe 29 PID 2240 wrote to memory of 2880 2240 updatecheckercitron.exe 32 PID 2240 wrote to memory of 2880 2240 updatecheckercitron.exe 32 PID 2240 wrote to memory of 2880 2240 updatecheckercitron.exe 32 PID 2240 wrote to memory of 2608 2240 updatecheckercitron.exe 34 PID 2240 wrote to memory of 2608 2240 updatecheckercitron.exe 34 PID 2240 wrote to memory of 2608 2240 updatecheckercitron.exe 34 PID 2240 wrote to memory of 2896 2240 updatecheckercitron.exe 36 PID 2240 wrote to memory of 2896 2240 updatecheckercitron.exe 36 PID 2240 wrote to memory of 2896 2240 updatecheckercitron.exe 36 PID 2240 wrote to memory of 1568 2240 updatecheckercitron.exe 38 PID 2240 wrote to memory of 1568 2240 updatecheckercitron.exe 38 PID 2240 wrote to memory of 1568 2240 updatecheckercitron.exe 38 PID 2240 wrote to memory of 2960 2240 updatecheckercitron.exe 40 PID 2240 wrote to memory of 2960 2240 updatecheckercitron.exe 40 PID 2240 wrote to memory of 2960 2240 updatecheckercitron.exe 40 PID 2240 wrote to memory of 2144 2240 updatecheckercitron.exe 42 PID 2240 wrote to memory of 2144 2240 updatecheckercitron.exe 42 PID 2240 wrote to memory of 2144 2240 updatecheckercitron.exe 42 PID 2240 wrote to memory of 1740 2240 updatecheckercitron.exe 44 PID 2240 wrote to memory of 1740 2240 updatecheckercitron.exe 44 PID 2240 wrote to memory of 1740 2240 updatecheckercitron.exe 44 PID 2240 wrote to memory of 436 2240 updatecheckercitron.exe 46 PID 2240 wrote to memory of 436 2240 updatecheckercitron.exe 46 PID 2240 wrote to memory of 436 2240 updatecheckercitron.exe 46 PID 2240 wrote to memory of 2232 2240 updatecheckercitron.exe 48 PID 2240 wrote to memory of 2232 2240 updatecheckercitron.exe 48 PID 2240 wrote to memory of 2232 2240 updatecheckercitron.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\citrontoppest\citrontoppest\updatechecker\updatecheckercitron.exe"C:\Users\Admin\AppData\Local\Temp\citrontoppest\citrontoppest\updatechecker\updatecheckercitron.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\citrontoppest\citrontoppest\updatechecker\updatecheckercitron.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2144
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:436
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ec286ba695ad926c878e44899129278e
SHA11a60f302ea3efcbf74f5a3b74bfc6fc3a0a05f8b
SHA2565c75bec46f04728dc77c27fccd17f78666e17aeea81d0ffd802a579e94ff5e4c
SHA512bc78284b927b82ce5a3ab48e076686fede1f746784e3c777ecf2959636f9ee8b4e3732484dec9af3e60b5d7caf83eefcb1db2b527a5d347980830ba732bd69ec