Overview

overview

10

Static

static

3

SynsWaveV1.exe

windows10-2004-x64

10

SynsWaveV1.exe

windows10-1703-x64

10

SynsWaveV1.exe

windows7-x64

10

SynsWaveV1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/09/2024, 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SynsWaveV1.exe

  • Size

    358KB

  • MD5

    fe2e1aa24f67aef8cca2a83269e49eb8

  • SHA1

    22eff1e84d25f5daf052a046c4c6a66c37f63cc4

  • SHA256

    712a0d5ea39f3325f80d76423fa07d8796bf0b75d35d69e8b32714d8836dfd50

  • SHA512

    97a7dc677ee2c8ca61729b2ec0532a2d59fb705d413c76f2f5b197053d15cd462a560038e49a75c4b76b3c9255a48690a97dfd7d89d81692c37a7547c6bad837

  • SSDEEP

    6144:o5aLkSNxlSl2ZvRbTs6iG0GkBnTYQSeMMHg/dRS4Y83PUf0KrZUNsC:AfG+2ZRQ7GdynTYQSMAV44YGPNKraS

Score
10/10
umbralxwormexecutionpersistenceratstealertrojan

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1287356979475386418/SjsKMoKntf-tJwWJfIOoeVJTxW-pZZsUeBXbJHYWlQ4Unqm9uEyyu-DxEGFodPCSL8F6

Extracted

Family

xworm

C2

expected-schema.gl.at.ply.gg:2980

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops startup file 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe
    "C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe
      "C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2136
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2116
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4564
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2016
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\RuntimeBroker"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3088
    • C:\Users\Admin\AppData\Roaming\SynsWave.exe
      "C:\Users\Admin\AppData\Roaming\SynsWave.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:4860
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2468
    • C:\Users\Admin\RuntimeBroker
      C:\Users\Admin\RuntimeBroker
      1⤵
      • Executes dropped EXE
      PID:4668
    • C:\Users\Admin\RuntimeBroker
      C:\Users\Admin\RuntimeBroker
      1⤵
      • Executes dropped EXE
      PID:348
    • C:\Users\Admin\RuntimeBroker
      C:\Users\Admin\RuntimeBroker
      1⤵
      • Executes dropped EXE
      PID:2572
    • C:\Users\Admin\RuntimeBroker
      C:\Users\Admin\RuntimeBroker
      1⤵
      • Executes dropped EXE
      PID:1344
    • C:\Users\Admin\RuntimeBroker
      C:\Users\Admin\RuntimeBroker
      1⤵
      • Executes dropped EXE
      PID:664

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.log
      Filesize

      654B

      MD5

      16c5fce5f7230eea11598ec11ed42862

      SHA1

      75392d4824706090f5e8907eee1059349c927600

      SHA256

      87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

      SHA512

      153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      ad5cd538ca58cb28ede39c108acb5785

      SHA1

      1ae910026f3dbe90ed025e9e96ead2b5399be877

      SHA256

      c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

      SHA512

      c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      43dae3e092de54f471b70e2bae25eaaf

      SHA1

      c6d84536fc53a5d40de779ff9f77b15cb7d1ab4a

      SHA256

      cfeee9bbb69bece3bdcba4af6bf3d20e9a9bd70c4dcf2328a44eac6a6958af07

      SHA512

      29542bdc0a632e143ed24baa03f6f1221028fb3fbbf254e2c844a003a9978b2d5cc9183a0afbe8ced2a62b822071b354cef41d9475ac9b0b28cb9380da121e52

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      7f54a331bf3258023d4902d80fea8476

      SHA1

      be4e077ac23ddaafb4ee954fd8f9562b0635ed44

      SHA256

      823b31436d5b504f2fe28c6ae4eb7dea4a2340c44574cb6b59b2adeedef1e089

      SHA512

      6e17407c90cda604856bd7014c77b289b69bf62901bc0d38a31b89fe219a22cbb5f10216d1c3263a11f9b1cc30e72ae5ed87b4e50501dea4440b842fd7f4180e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      db4cc15dff442379601b9d13c80ceb0c

      SHA1

      abb9365ff639e2be60358b4b0300c26114539521

      SHA256

      0cb2d77b985fbc42fe99aa379c2f9c1e10617ae706a0038a6c34c4b148fa5e6c

      SHA512

      2b591b54d9e81c598433e7be6fa68bd360a8934d4394cad657e900d99e47fc30d4d7faa8be333450d9d68dbceb8ac908dd2529aeb6ddec2c33cdae69025c891a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5kbioopm.lg5.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      Download Submit

    • C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe
      Filesize

      229KB

      MD5

      8bb8292d00e8218192562b888b4d7671

      SHA1

      61a03523336bd54964fbb62338027673d0a138cb

      SHA256

      a9f8c9cf4ceadfa6bc56ab230c8dfe8a7018e1123ba01039a4059b1814b757a0

      SHA512

      c19a19dd6b49cc237e751db9d58db56e745f7d00c8d81397928fddef8902b9abec4b9331573be9478d33554c6b77b4f52a055bf2251300736035b5eec24faa1e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk
      Filesize

      784B

      MD5

      a7c48945a08d78cd9e3784aa2ec7b23a

      SHA1

      f3850e4703295a31dbfe057dee9e84d413289532

      SHA256

      987d728c0d894bb2ab4b0c707b0ded2c6329fa757133923a27cb978d95542927

      SHA512

      781870b54b71181df82276fa955f3f3c68c32b8e753754863955e0fd9948bc0d1892a4d1118e23a6d97a8eb0c3fe55a084871b2ed34b86748169469b587ffd58

      Download Submit

    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      Filesize

      94KB

      MD5

      5e6bae23e86272120e9ccfa3413ece3e

      SHA1

      7cf89daa0119650ec13ef056c143249c4002a4f1

      SHA256

      116b46762acbc220ec42b00329392668bf3e24cc00a650f68013465c319cbf4d

      SHA512

      7a607b3e850f930794bc493aa68d0ecf236a23e98ee912e279b1649bd0e2110e01cefcc5259744c06e1b4a8cccaececdde6c2f18ef8d252414cb461bdd9d3f0d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\SynsWave.exe
      Filesize

      25KB

      MD5

      12e7359129744823438f3d6b97192955

      SHA1

      89872a5a18abefe25d10efa824281718cf85ae39

      SHA256

      348086f9bd5939a48efcc94702271c1caf92ea11f3b0385367daf9530b51cf3e

      SHA512

      b38516752817d3ac6541d300cc17176c5bf1c38d321fd19c006cb1f5cf9d5ab7a228184ed267636841225e718f71d9cd8aed5e53e36c7ee3548ed6958b9e8563

      Download Submit

    • memory/1452-14-0x00000202DBAB0000-0x00000202DBAF0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1452-23-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1452-19-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1824-31-0x000002607FA10000-0x000002607FA86000-memory.dmp

      Filesize

      472KB

      Download

    • memory/1824-28-0x000002607F860000-0x000002607F882000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2364-21-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2364-18-0x0000000000040000-0x000000000005E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2364-209-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4880-1-0x0000000000160000-0x00000000001C0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/4880-0-0x00007FFA64193000-0x00007FFA64194000-memory.dmp

      Filesize

      4KB

      Download