umbral | 712a0d5ea39f3325f80d76423fa07d8796bf0b75d35d69e8b32714d8836dfd50

Analysis

max time kernel
148s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-09-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SynsWaveV1.exe
Size

358KB
MD5

fe2e1aa24f67aef8cca2a83269e49eb8
SHA1

22eff1e84d25f5daf052a046c4c6a66c37f63cc4
SHA256

712a0d5ea39f3325f80d76423fa07d8796bf0b75d35d69e8b32714d8836dfd50
SHA512

97a7dc677ee2c8ca61729b2ec0532a2d59fb705d413c76f2f5b197053d15cd462a560038e49a75c4b76b3c9255a48690a97dfd7d89d81692c37a7547c6bad837
SSDEEP

6144:o5aLkSNxlSl2ZvRbTs6iG0GkBnTYQSeMMHg/dRS4Y83PUf0KrZUNsC:AfG+2ZRQ7GdynTYQSMAV44YGPNKraS

Score

10^/10

umbral xworm execution persistence rat stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1287356979475386418/SjsKMoKntf-tJwWJfIOoeVJTxW-pZZsUeBXbJHYWlQ4Unqm9uEyyu-DxEGFodPCSL8F6

Extracted

Family

xworm

expected-schema.gl.at.ply.gg:2980

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001ab69-7.dat	family_umbral
behavioral2/memory/4912-15-0x0000018FAC6B0000-0x0000018FAC6F0000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000001ac4f-14.dat	family_xworm
behavioral2/memory/3620-18-0x0000000000170000-0x000000000018E000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
200	powershell.exe
1576	powershell.exe
4236	powershell.exe
1052	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	RuntimeBroker.exe

Executes dropped EXE 5 IoCs

pid	Process
4912	MISHA_litvin.exe
3620	RuntimeBroker.exe
320	SynsWave.exe
4976	RuntimeBroker
3788	RuntimeBroker

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\RuntimeBroker"	RuntimeBroker.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
200	powershell.exe
200	powershell.exe
200	powershell.exe
1576	powershell.exe
1576	powershell.exe
1576	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
3620	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	RuntimeBroker.exe
Token: SeDebugPrivilege	4912	MISHA_litvin.exe
Token: SeIncreaseQuotaPrivilege	3892	wmic.exe
Token: SeSecurityPrivilege	3892	wmic.exe
Token: SeTakeOwnershipPrivilege	3892	wmic.exe
Token: SeLoadDriverPrivilege	3892	wmic.exe
Token: SeSystemProfilePrivilege	3892	wmic.exe
Token: SeSystemtimePrivilege	3892	wmic.exe
Token: SeProfSingleProcessPrivilege	3892	wmic.exe
Token: SeIncBasePriorityPrivilege	3892	wmic.exe
Token: SeCreatePagefilePrivilege	3892	wmic.exe
Token: SeBackupPrivilege	3892	wmic.exe
Token: SeRestorePrivilege	3892	wmic.exe
Token: SeShutdownPrivilege	3892	wmic.exe
Token: SeDebugPrivilege	3892	wmic.exe
Token: SeSystemEnvironmentPrivilege	3892	wmic.exe
Token: SeRemoteShutdownPrivilege	3892	wmic.exe
Token: SeUndockPrivilege	3892	wmic.exe
Token: SeManageVolumePrivilege	3892	wmic.exe
Token: 33	3892	wmic.exe
Token: 34	3892	wmic.exe
Token: 35	3892	wmic.exe
Token: 36	3892	wmic.exe
Token: SeIncreaseQuotaPrivilege	3892	wmic.exe
Token: SeSecurityPrivilege	3892	wmic.exe
Token: SeTakeOwnershipPrivilege	3892	wmic.exe
Token: SeLoadDriverPrivilege	3892	wmic.exe
Token: SeSystemProfilePrivilege	3892	wmic.exe
Token: SeSystemtimePrivilege	3892	wmic.exe
Token: SeProfSingleProcessPrivilege	3892	wmic.exe
Token: SeIncBasePriorityPrivilege	3892	wmic.exe
Token: SeCreatePagefilePrivilege	3892	wmic.exe
Token: SeBackupPrivilege	3892	wmic.exe
Token: SeRestorePrivilege	3892	wmic.exe
Token: SeShutdownPrivilege	3892	wmic.exe
Token: SeDebugPrivilege	3892	wmic.exe
Token: SeSystemEnvironmentPrivilege	3892	wmic.exe
Token: SeRemoteShutdownPrivilege	3892	wmic.exe
Token: SeUndockPrivilege	3892	wmic.exe
Token: SeManageVolumePrivilege	3892	wmic.exe
Token: 33	3892	wmic.exe
Token: 34	3892	wmic.exe
Token: 35	3892	wmic.exe
Token: 36	3892	wmic.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeIncreaseQuotaPrivilege	200	powershell.exe
Token: SeSecurityPrivilege	200	powershell.exe
Token: SeTakeOwnershipPrivilege	200	powershell.exe
Token: SeLoadDriverPrivilege	200	powershell.exe
Token: SeSystemProfilePrivilege	200	powershell.exe
Token: SeSystemtimePrivilege	200	powershell.exe
Token: SeProfSingleProcessPrivilege	200	powershell.exe
Token: SeIncBasePriorityPrivilege	200	powershell.exe
Token: SeCreatePagefilePrivilege	200	powershell.exe
Token: SeBackupPrivilege	200	powershell.exe
Token: SeRestorePrivilege	200	powershell.exe
Token: SeShutdownPrivilege	200	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeSystemEnvironmentPrivilege	200	powershell.exe
Token: SeRemoteShutdownPrivilege	200	powershell.exe
Token: SeUndockPrivilege	200	powershell.exe
Token: SeManageVolumePrivilege	200	powershell.exe
Token: 33	200	powershell.exe
Token: 34	200	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3620	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4912	4444	SynsWaveV1.exe	73
PID 4444 wrote to memory of 4912	4444	SynsWaveV1.exe	73
PID 4444 wrote to memory of 3620	4444	SynsWaveV1.exe	74
PID 4444 wrote to memory of 3620	4444	SynsWaveV1.exe	74
PID 4444 wrote to memory of 320	4444	SynsWaveV1.exe	75
PID 4444 wrote to memory of 320	4444	SynsWaveV1.exe	75
PID 320 wrote to memory of 820	320	SynsWave.exe	77
PID 320 wrote to memory of 820	320	SynsWave.exe	77
PID 4912 wrote to memory of 3892	4912	MISHA_litvin.exe	78
PID 4912 wrote to memory of 3892	4912	MISHA_litvin.exe	78
PID 3620 wrote to memory of 200	3620	RuntimeBroker.exe	81
PID 3620 wrote to memory of 200	3620	RuntimeBroker.exe	81
PID 3620 wrote to memory of 1576	3620	RuntimeBroker.exe	84
PID 3620 wrote to memory of 1576	3620	RuntimeBroker.exe	84
PID 3620 wrote to memory of 4236	3620	RuntimeBroker.exe	86
PID 3620 wrote to memory of 4236	3620	RuntimeBroker.exe	86
PID 3620 wrote to memory of 1052	3620	RuntimeBroker.exe	88
PID 3620 wrote to memory of 1052	3620	RuntimeBroker.exe	88
PID 3620 wrote to memory of 1400	3620	RuntimeBroker.exe	90
PID 3620 wrote to memory of 1400	3620	RuntimeBroker.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe
"C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe
  "C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1052
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\RuntimeBroker"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1400
- C:\Users\Admin\AppData\Roaming\SynsWave.exe
  "C:\Users\Admin\AppData\Roaming\SynsWave.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:820

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:4976

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.log

Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
be1c674958dbef0481690e37a195269e

SHA1
7fdd51d2d7f619ae7b0eb4d0b843e7fabfe3f064

SHA256
f7811d79eaa3d5fff57f97dc46d3d886022bb86122fc56c7ece5fd3736962bb3

SHA512
c5cb643c8a5e8d6922e39038ed5eb724d5d481dd40a3bf6f325dab476731b57e35ff6262051d8a3d4dfef804834f0f4e8f16fb2e3b83e94361ec6d44316b89b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e2ee371a713b75f2b094fe853da860d3

SHA1
25cd8ff640445f0b36ef96955f8eb33fd95f0d14

SHA256
518688356860956ce4b7a12530113f5da15b3a52ff353220621198359a746c05

SHA512
f5d25c222b6d2aa33c8dead462de1c3eec4cbe0d0a5f149696bddd20243a5b0e06d2dd057eae1e6559101e744aaa48f3e41d7825695e526f73d43629f4b5d550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2c2b940988d1b52ea721fe23d4219f59

SHA1
6cecbe6cf36fde2729c81903ff92b8bd46f5c50d

SHA256
74056737a14b44ae138b3f13fcc45f86b311bf47f6bbe8486a4185c4b720c450

SHA512
31ba2532317473b532711ebb04ec7b6bb067fe8fc99dcd2dc9cc500068c169bfc59e605aa71922aef345c17805cba536434e2e525f2727da85b1fcaff085a3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ww2auu1.l0o.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe

Filesize
229KB

MD5
8bb8292d00e8218192562b888b4d7671

SHA1
61a03523336bd54964fbb62338027673d0a138cb

SHA256
a9f8c9cf4ceadfa6bc56ab230c8dfe8a7018e1123ba01039a4059b1814b757a0

SHA512
c19a19dd6b49cc237e751db9d58db56e745f7d00c8d81397928fddef8902b9abec4b9331573be9478d33554c6b77b4f52a055bf2251300736035b5eec24faa1e

Download Submit
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

Filesize
94KB

MD5
5e6bae23e86272120e9ccfa3413ece3e

SHA1
7cf89daa0119650ec13ef056c143249c4002a4f1

SHA256
116b46762acbc220ec42b00329392668bf3e24cc00a650f68013465c319cbf4d

SHA512
7a607b3e850f930794bc493aa68d0ecf236a23e98ee912e279b1649bd0e2110e01cefcc5259744c06e1b4a8cccaececdde6c2f18ef8d252414cb461bdd9d3f0d

Download Submit
C:\Users\Admin\AppData\Roaming\SynsWave.exe

Filesize
25KB

MD5
12e7359129744823438f3d6b97192955

SHA1
89872a5a18abefe25d10efa824281718cf85ae39

SHA256
348086f9bd5939a48efcc94702271c1caf92ea11f3b0385367daf9530b51cf3e

SHA512
b38516752817d3ac6541d300cc17176c5bf1c38d321fd19c006cb1f5cf9d5ab7a228184ed267636841225e718f71d9cd8aed5e53e36c7ee3548ed6958b9e8563

Download Submit
memory/200-28-0x00000168FF5D0000-0x00000168FF5F2000-memory.dmp

Filesize
136KB

Download
memory/200-31-0x00000168FF780000-0x00000168FF7F6000-memory.dmp

Filesize
472KB

Download
memory/3620-21-0x00007FFEFE880000-0x00007FFEFF26C000-memory.dmp

Filesize
9.9MB

Download
memory/3620-18-0x0000000000170000-0x000000000018E000-memory.dmp

Filesize
120KB

Download
memory/3620-202-0x00007FFEFE880000-0x00007FFEFF26C000-memory.dmp

Filesize
9.9MB

Download
memory/4444-0-0x00007FFEFE883000-0x00007FFEFE884000-memory.dmp

Filesize
4KB

Download
memory/4444-1-0x00000000008A0000-0x0000000000900000-memory.dmp

Filesize
384KB

Download
memory/4912-23-0x00007FFEFE880000-0x00007FFEFF26C000-memory.dmp

Filesize
9.9MB

Download
memory/4912-19-0x00007FFEFE880000-0x00007FFEFF26C000-memory.dmp

Filesize
9.9MB

Download
memory/4912-15-0x0000018FAC6B0000-0x0000018FAC6F0000-memory.dmp

Filesize
256KB

Download