Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 19:24
Behavioral task
behavioral1
Sample
skibidi skid.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
skibidi skid.exe
-
Size
230KB
-
MD5
bb321be2af41fd03a125e37f7146a591
-
SHA1
8fdc2f2fe8928810dd4db7e40a81c636f949e106
-
SHA256
f24cbf246983996d9ae69e742f690f681bceaeba18d16eb23239312f8e0d71d8
-
SHA512
c3e5154be7229cf549bf0d2f7607efc07dece886496e7245fdd28960350fd94cdbdf0a650bd5ed258c750616f2c7ddcfddf0925a4ab1fc7c1df4756755959003
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD4ze6ESQPL4UBECDjayGrcb8e1mzbi:foZtL+EP8ze6ESQPL4UBECDja5AF
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1600-1-0x0000000000CD0000-0x0000000000D10000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1600 skibidi skid.exe Token: SeIncreaseQuotaPrivilege 1336 wmic.exe Token: SeSecurityPrivilege 1336 wmic.exe Token: SeTakeOwnershipPrivilege 1336 wmic.exe Token: SeLoadDriverPrivilege 1336 wmic.exe Token: SeSystemProfilePrivilege 1336 wmic.exe Token: SeSystemtimePrivilege 1336 wmic.exe Token: SeProfSingleProcessPrivilege 1336 wmic.exe Token: SeIncBasePriorityPrivilege 1336 wmic.exe Token: SeCreatePagefilePrivilege 1336 wmic.exe Token: SeBackupPrivilege 1336 wmic.exe Token: SeRestorePrivilege 1336 wmic.exe Token: SeShutdownPrivilege 1336 wmic.exe Token: SeDebugPrivilege 1336 wmic.exe Token: SeSystemEnvironmentPrivilege 1336 wmic.exe Token: SeRemoteShutdownPrivilege 1336 wmic.exe Token: SeUndockPrivilege 1336 wmic.exe Token: SeManageVolumePrivilege 1336 wmic.exe Token: 33 1336 wmic.exe Token: 34 1336 wmic.exe Token: 35 1336 wmic.exe Token: SeIncreaseQuotaPrivilege 1336 wmic.exe Token: SeSecurityPrivilege 1336 wmic.exe Token: SeTakeOwnershipPrivilege 1336 wmic.exe Token: SeLoadDriverPrivilege 1336 wmic.exe Token: SeSystemProfilePrivilege 1336 wmic.exe Token: SeSystemtimePrivilege 1336 wmic.exe Token: SeProfSingleProcessPrivilege 1336 wmic.exe Token: SeIncBasePriorityPrivilege 1336 wmic.exe Token: SeCreatePagefilePrivilege 1336 wmic.exe Token: SeBackupPrivilege 1336 wmic.exe Token: SeRestorePrivilege 1336 wmic.exe Token: SeShutdownPrivilege 1336 wmic.exe Token: SeDebugPrivilege 1336 wmic.exe Token: SeSystemEnvironmentPrivilege 1336 wmic.exe Token: SeRemoteShutdownPrivilege 1336 wmic.exe Token: SeUndockPrivilege 1336 wmic.exe Token: SeManageVolumePrivilege 1336 wmic.exe Token: 33 1336 wmic.exe Token: 34 1336 wmic.exe Token: 35 1336 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1336 1600 skibidi skid.exe 30 PID 1600 wrote to memory of 1336 1600 skibidi skid.exe 30 PID 1600 wrote to memory of 1336 1600 skibidi skid.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\skibidi skid.exe"C:\Users\Admin\AppData\Local\Temp\skibidi skid.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336
-