Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 20:24
Behavioral task
behavioral1
Sample
Neverlose.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Neverlose.exe
-
Size
231KB
-
MD5
2a9d5da0bb69d53e1b68178bc63e9390
-
SHA1
b1170f7ca36ea613188a272dc8ff8720a586de3a
-
SHA256
b575e722311556b67bc4f2ff77470063e5453e8f9952ddcd33afec9bdefc3902
-
SHA512
372288f96c8d39cba9529e7c44ce4b083eddf50dc3c3317b7b97c02d07018cdc2e0913da3e8309d548f80d68c95b9dd65e4febd4d7ca3b4d6a8df3360cf6aca3
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4ZvHYe5xypXKYZd8ZC6lY8e1mGi:joZtL+EP8pHYe5xypXKYZd8dk2
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2756-1-0x00000000009C0000-0x0000000000A00000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2756 Neverlose.exe Token: SeIncreaseQuotaPrivilege 2768 wmic.exe Token: SeSecurityPrivilege 2768 wmic.exe Token: SeTakeOwnershipPrivilege 2768 wmic.exe Token: SeLoadDriverPrivilege 2768 wmic.exe Token: SeSystemProfilePrivilege 2768 wmic.exe Token: SeSystemtimePrivilege 2768 wmic.exe Token: SeProfSingleProcessPrivilege 2768 wmic.exe Token: SeIncBasePriorityPrivilege 2768 wmic.exe Token: SeCreatePagefilePrivilege 2768 wmic.exe Token: SeBackupPrivilege 2768 wmic.exe Token: SeRestorePrivilege 2768 wmic.exe Token: SeShutdownPrivilege 2768 wmic.exe Token: SeDebugPrivilege 2768 wmic.exe Token: SeSystemEnvironmentPrivilege 2768 wmic.exe Token: SeRemoteShutdownPrivilege 2768 wmic.exe Token: SeUndockPrivilege 2768 wmic.exe Token: SeManageVolumePrivilege 2768 wmic.exe Token: 33 2768 wmic.exe Token: 34 2768 wmic.exe Token: 35 2768 wmic.exe Token: SeIncreaseQuotaPrivilege 2768 wmic.exe Token: SeSecurityPrivilege 2768 wmic.exe Token: SeTakeOwnershipPrivilege 2768 wmic.exe Token: SeLoadDriverPrivilege 2768 wmic.exe Token: SeSystemProfilePrivilege 2768 wmic.exe Token: SeSystemtimePrivilege 2768 wmic.exe Token: SeProfSingleProcessPrivilege 2768 wmic.exe Token: SeIncBasePriorityPrivilege 2768 wmic.exe Token: SeCreatePagefilePrivilege 2768 wmic.exe Token: SeBackupPrivilege 2768 wmic.exe Token: SeRestorePrivilege 2768 wmic.exe Token: SeShutdownPrivilege 2768 wmic.exe Token: SeDebugPrivilege 2768 wmic.exe Token: SeSystemEnvironmentPrivilege 2768 wmic.exe Token: SeRemoteShutdownPrivilege 2768 wmic.exe Token: SeUndockPrivilege 2768 wmic.exe Token: SeManageVolumePrivilege 2768 wmic.exe Token: 33 2768 wmic.exe Token: 34 2768 wmic.exe Token: 35 2768 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2768 2756 Neverlose.exe 30 PID 2756 wrote to memory of 2768 2756 Neverlose.exe 30 PID 2756 wrote to memory of 2768 2756 Neverlose.exe 30