Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 19:29
Behavioral task
behavioral1
Sample
skibidi skid who shall i steal today.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
General
-
Target
skibidi skid who shall i steal today.exe
-
Size
227KB
-
MD5
8f0d6e03ee2f791e3270d682778c4a3c
-
SHA1
0f796d86fc10b2170d4e2875ae4bb7c157c01f67
-
SHA256
9eefe406aa13dcf0b6e144ac5c78233fca22d813e22091dcfdc13deb82ca1925
-
SHA512
f3c2521ff9a44cffa41800cf208c3230610bcd6037f76b9220880790106fa0adfea7d626c4aaf7ef4d15136296b5ee2c9fd03e1fde7fde63a74174021db3d2f1
-
SSDEEP
6144:+loZM+rIkd8g+EtXHkv/iD4BC1bbhS6FAAxDeeb3k2+lb8e1mnwi:ooZtL+EP881bbhS6FAAxDeeb3ktCp
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2324-1-0x0000000000080000-0x00000000000C0000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2324 skibidi skid who shall i steal today.exe Token: SeIncreaseQuotaPrivilege 2224 wmic.exe Token: SeSecurityPrivilege 2224 wmic.exe Token: SeTakeOwnershipPrivilege 2224 wmic.exe Token: SeLoadDriverPrivilege 2224 wmic.exe Token: SeSystemProfilePrivilege 2224 wmic.exe Token: SeSystemtimePrivilege 2224 wmic.exe Token: SeProfSingleProcessPrivilege 2224 wmic.exe Token: SeIncBasePriorityPrivilege 2224 wmic.exe Token: SeCreatePagefilePrivilege 2224 wmic.exe Token: SeBackupPrivilege 2224 wmic.exe Token: SeRestorePrivilege 2224 wmic.exe Token: SeShutdownPrivilege 2224 wmic.exe Token: SeDebugPrivilege 2224 wmic.exe Token: SeSystemEnvironmentPrivilege 2224 wmic.exe Token: SeRemoteShutdownPrivilege 2224 wmic.exe Token: SeUndockPrivilege 2224 wmic.exe Token: SeManageVolumePrivilege 2224 wmic.exe Token: 33 2224 wmic.exe Token: 34 2224 wmic.exe Token: 35 2224 wmic.exe Token: SeIncreaseQuotaPrivilege 2224 wmic.exe Token: SeSecurityPrivilege 2224 wmic.exe Token: SeTakeOwnershipPrivilege 2224 wmic.exe Token: SeLoadDriverPrivilege 2224 wmic.exe Token: SeSystemProfilePrivilege 2224 wmic.exe Token: SeSystemtimePrivilege 2224 wmic.exe Token: SeProfSingleProcessPrivilege 2224 wmic.exe Token: SeIncBasePriorityPrivilege 2224 wmic.exe Token: SeCreatePagefilePrivilege 2224 wmic.exe Token: SeBackupPrivilege 2224 wmic.exe Token: SeRestorePrivilege 2224 wmic.exe Token: SeShutdownPrivilege 2224 wmic.exe Token: SeDebugPrivilege 2224 wmic.exe Token: SeSystemEnvironmentPrivilege 2224 wmic.exe Token: SeRemoteShutdownPrivilege 2224 wmic.exe Token: SeUndockPrivilege 2224 wmic.exe Token: SeManageVolumePrivilege 2224 wmic.exe Token: 33 2224 wmic.exe Token: 34 2224 wmic.exe Token: 35 2224 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2224 2324 skibidi skid who shall i steal today.exe 28 PID 2324 wrote to memory of 2224 2324 skibidi skid who shall i steal today.exe 28 PID 2324 wrote to memory of 2224 2324 skibidi skid who shall i steal today.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\skibidi skid who shall i steal today.exe"C:\Users\Admin\AppData\Local\Temp\skibidi skid who shall i steal today.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224
-