Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-09-2024 15:55
Behavioral task
behavioral1
Sample
botCreator.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
botCreator.exe
-
Size
488KB
-
MD5
668d42a2877f3c06ca17a413325174d4
-
SHA1
697e43404eb5e6a36f529cdd96321956ac809b3e
-
SHA256
4c19159d4f39a778bc189a23249cbb1f3985e8203dea388aaffb0493c64d7763
-
SHA512
b475b3e505d76e99f0d3de5214633749cfb62b724a71797440a383ddc08c6e8b82ca9dfa411a2c8c8cec7e5aa10c24d9d8b8dea31fb20d2b58e73de1f43962ed
-
SSDEEP
12288:WoZ1tlRk83MlrfFwiAfboTxUyzzq4HRPVgk9dRv/:f5r3YFwiAfboTxUyzzq4xPVP
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2368-1-0x0000000000AE0000-0x0000000000B60000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2368 botCreator.exe Token: SeIncreaseQuotaPrivilege 1928 wmic.exe Token: SeSecurityPrivilege 1928 wmic.exe Token: SeTakeOwnershipPrivilege 1928 wmic.exe Token: SeLoadDriverPrivilege 1928 wmic.exe Token: SeSystemProfilePrivilege 1928 wmic.exe Token: SeSystemtimePrivilege 1928 wmic.exe Token: SeProfSingleProcessPrivilege 1928 wmic.exe Token: SeIncBasePriorityPrivilege 1928 wmic.exe Token: SeCreatePagefilePrivilege 1928 wmic.exe Token: SeBackupPrivilege 1928 wmic.exe Token: SeRestorePrivilege 1928 wmic.exe Token: SeShutdownPrivilege 1928 wmic.exe Token: SeDebugPrivilege 1928 wmic.exe Token: SeSystemEnvironmentPrivilege 1928 wmic.exe Token: SeRemoteShutdownPrivilege 1928 wmic.exe Token: SeUndockPrivilege 1928 wmic.exe Token: SeManageVolumePrivilege 1928 wmic.exe Token: 33 1928 wmic.exe Token: 34 1928 wmic.exe Token: 35 1928 wmic.exe Token: SeIncreaseQuotaPrivilege 1928 wmic.exe Token: SeSecurityPrivilege 1928 wmic.exe Token: SeTakeOwnershipPrivilege 1928 wmic.exe Token: SeLoadDriverPrivilege 1928 wmic.exe Token: SeSystemProfilePrivilege 1928 wmic.exe Token: SeSystemtimePrivilege 1928 wmic.exe Token: SeProfSingleProcessPrivilege 1928 wmic.exe Token: SeIncBasePriorityPrivilege 1928 wmic.exe Token: SeCreatePagefilePrivilege 1928 wmic.exe Token: SeBackupPrivilege 1928 wmic.exe Token: SeRestorePrivilege 1928 wmic.exe Token: SeShutdownPrivilege 1928 wmic.exe Token: SeDebugPrivilege 1928 wmic.exe Token: SeSystemEnvironmentPrivilege 1928 wmic.exe Token: SeRemoteShutdownPrivilege 1928 wmic.exe Token: SeUndockPrivilege 1928 wmic.exe Token: SeManageVolumePrivilege 1928 wmic.exe Token: 33 1928 wmic.exe Token: 34 1928 wmic.exe Token: 35 1928 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1928 2368 botCreator.exe 31 PID 2368 wrote to memory of 1928 2368 botCreator.exe 31 PID 2368 wrote to memory of 1928 2368 botCreator.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\botCreator.exe"C:\Users\Admin\AppData\Local\Temp\botCreator.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928
-