Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 20:53
Behavioral task
behavioral1
Sample
release07052024.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
General
-
Target
release07052024.exe
-
Size
234KB
-
MD5
b7003ff817ee11ddb615fd88dd82fdcf
-
SHA1
43cb7c473ddcff872931ed0628cf25543cd56593
-
SHA256
2d1d0f47365bdb80e32d3378591b13b6412d2b67071d8083f95c8317cfa60fef
-
SHA512
b5ba5b1c858623a2d75316199229fc2dad581200b874ef2907d795948d79605237e7195365d81eedf3c5db9cd8c1542d638cd94ca47fb9911502e6596269ec6e
-
SSDEEP
6144:XloZM+rIkd8g+EtXHkv/iD4ZDmsN8e1mqtiU:1oZtL+EP8ZdG
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2796-1-0x0000000000C40000-0x0000000000C80000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2796 release07052024.exe Token: SeIncreaseQuotaPrivilege 2364 wmic.exe Token: SeSecurityPrivilege 2364 wmic.exe Token: SeTakeOwnershipPrivilege 2364 wmic.exe Token: SeLoadDriverPrivilege 2364 wmic.exe Token: SeSystemProfilePrivilege 2364 wmic.exe Token: SeSystemtimePrivilege 2364 wmic.exe Token: SeProfSingleProcessPrivilege 2364 wmic.exe Token: SeIncBasePriorityPrivilege 2364 wmic.exe Token: SeCreatePagefilePrivilege 2364 wmic.exe Token: SeBackupPrivilege 2364 wmic.exe Token: SeRestorePrivilege 2364 wmic.exe Token: SeShutdownPrivilege 2364 wmic.exe Token: SeDebugPrivilege 2364 wmic.exe Token: SeSystemEnvironmentPrivilege 2364 wmic.exe Token: SeRemoteShutdownPrivilege 2364 wmic.exe Token: SeUndockPrivilege 2364 wmic.exe Token: SeManageVolumePrivilege 2364 wmic.exe Token: 33 2364 wmic.exe Token: 34 2364 wmic.exe Token: 35 2364 wmic.exe Token: SeIncreaseQuotaPrivilege 2364 wmic.exe Token: SeSecurityPrivilege 2364 wmic.exe Token: SeTakeOwnershipPrivilege 2364 wmic.exe Token: SeLoadDriverPrivilege 2364 wmic.exe Token: SeSystemProfilePrivilege 2364 wmic.exe Token: SeSystemtimePrivilege 2364 wmic.exe Token: SeProfSingleProcessPrivilege 2364 wmic.exe Token: SeIncBasePriorityPrivilege 2364 wmic.exe Token: SeCreatePagefilePrivilege 2364 wmic.exe Token: SeBackupPrivilege 2364 wmic.exe Token: SeRestorePrivilege 2364 wmic.exe Token: SeShutdownPrivilege 2364 wmic.exe Token: SeDebugPrivilege 2364 wmic.exe Token: SeSystemEnvironmentPrivilege 2364 wmic.exe Token: SeRemoteShutdownPrivilege 2364 wmic.exe Token: SeUndockPrivilege 2364 wmic.exe Token: SeManageVolumePrivilege 2364 wmic.exe Token: 33 2364 wmic.exe Token: 34 2364 wmic.exe Token: 35 2364 wmic.exe Token: SeDebugPrivilege 2740 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2364 2796 release07052024.exe 30 PID 2796 wrote to memory of 2364 2796 release07052024.exe 30 PID 2796 wrote to memory of 2364 2796 release07052024.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\release07052024.exe"C:\Users\Admin\AppData\Local\Temp\release07052024.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2740