Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
17/11/2024, 07:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe
- Size 81KB
- Sample241117-jbcapstnft
- SHA256 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb
- MD5 3e26f187dc7beea7d0a792a347e5ce26
- SHA1 4580dfccf5e0d151a5b25d87ef44d9e084083896
- SHA512 d16a6819e9b975554fc257f68cff3c299bb51a8b93933c592d9b74dac45580496c7cef6b0cd2602347bad2d36a35585c50b33983e3b3e96b7aa67e240ef99db4
- SSDEEP 1536:BteqGDlXvCDB04f5Gn/L8ZlALNtnd17i9wz:Olg35GTclABtnDi9wz
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" umbekoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" umbekoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" umbekoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" umbekoav.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F5A4D43-5653-5153-4F5A-4D4356535153}\IsInstalled = "1" umbekoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F5A4D43-5653-5153-4F5A-4D4356535153}\StubPath = "C:\\Windows\\system32\\kroatoab-asat.exe" umbekoav.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F5A4D43-5653-5153-4F5A-4D4356535153} umbekoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F5A4D43-5653-5153-4F5A-4D4356535153}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" umbekoav.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" umbekoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\etlootig-adeab.exe" umbekoav.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe umbekoav.exe - Executes dropped EXE 2 IoCs
pid Process 1096 umbekoav.exe 3640 umbekoav.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" umbekoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" umbekoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" umbekoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" umbekoav.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger umbekoav.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} umbekoav.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify umbekoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" umbekoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eahxoafoos-idat.dll" umbekoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" umbekoav.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\umbekoav.exe 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe File opened for modification C:\Windows\SysWOW64\etlootig-adeab.exe umbekoav.exe File created C:\Windows\SysWOW64\etlootig-adeab.exe umbekoav.exe File created C:\Windows\SysWOW64\kroatoab-asat.exe umbekoav.exe File opened for modification C:\Windows\SysWOW64\umbekoav.exe umbekoav.exe File created C:\Windows\SysWOW64\umbekoav.exe 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe File opened for modification C:\Windows\SysWOW64\kroatoab-asat.exe umbekoav.exe File opened for modification C:\Windows\SysWOW64\eahxoafoos-idat.dll umbekoav.exe File created C:\Windows\SysWOW64\eahxoafoos-idat.dll umbekoav.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language umbekoav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language umbekoav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 3640 umbekoav.exe 3640 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe 1096 umbekoav.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3552 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe Token: SeDebugPrivilege 1096 umbekoav.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3552 wrote to memory of 1096 3552 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe 83 PID 3552 wrote to memory of 1096 3552 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe 83 PID 3552 wrote to memory of 1096 3552 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe 83 PID 1096 wrote to memory of 616 1096 umbekoav.exe 5 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3640 1096 umbekoav.exe 84 PID 1096 wrote to memory of 3640 1096 umbekoav.exe 84 PID 1096 wrote to memory of 3640 1096 umbekoav.exe 84 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56 PID 1096 wrote to memory of 3520 1096 umbekoav.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe"C:\Users\Admin\AppData\Local\Temp\92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\umbekoav.exe"C:\Windows\system32\umbekoav.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\umbekoav.exe--k33p4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3640
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\eahxoafoos-idat.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\etlootig-adeab.exe
- Size 84KB
- SHA256 ca75464e40e3f7ae70da1fbf23610ad0786c95bb9386cfd415faa05dce3c92eb
- MD5 c2b001148a1b011505470d5ca86d6fdb
- SHA1 c8abbe092ef3118e4cee62d920ce7e8401d1be5f
- SHA512 64bfe039e105dbc37230d54d2367308ad5140afe45de3720270db61bc1009b00124e750dc334ac76e3a5c4ca477374d7b3ad5602b00541255a1bdbc9069cc6aa
- SSDEEP 1536:1jcYcEzIdxUTU6p3LGHmY804K9D8tcdRS8G11IMHDbqywjM:5A7lEyHt4KicdI8dTjM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kroatoab-asat.exe
- Size 83KB
- SHA256 a2cf24f39a8ca0b2038808fab0e0c7ecb32be28bbbe0481ecfd929231a6466f1
- MD5 48567ce663506985978d0e4abed41757
- SHA1 bfaee46035f8671da53cfdbb42b0b0b2240a29ad
- SHA512 00f4cfa0e84e6b72fcfff5d1384b96695c4fdedc65b03208401b66c7da9fa61e6da385013f281866aebe549647d01796d067c7e8ab3d1d2f326138dd96265481
- SSDEEP 1536:xkU7jxuDLR+t0d6NqBHgVHrvBLHl+IQYu1k6AcfRID9tHaLc:J8DLkt0Sq9ax+U+9HfqDfao
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\umbekoav.exe
- Size 81KB
- SHA256 92c8a42de1dd37a8e26096e300de041029594e5fb16f5ad01cadb0bace1037eb
- MD5 3e26f187dc7beea7d0a792a347e5ce26
- SHA1 4580dfccf5e0d151a5b25d87ef44d9e084083896
- SHA512 d16a6819e9b975554fc257f68cff3c299bb51a8b93933c592d9b74dac45580496c7cef6b0cd2602347bad2d36a35585c50b33983e3b3e96b7aa67e240ef99db4
- SSDEEP 1536:BteqGDlXvCDB04f5Gn/L8ZlALNtnd17i9wz:Olg35GTclABtnDi9wz
- MD5 SHA1 SHA512 SSDEEP