Overview
overview
10Static
static
10Netflix Ch...nt.dll
windows7-x64
1Netflix Ch...nt.dll
windows10-2004-x64
1Netflix Ch...et.dll
windows7-x64
1Netflix Ch...et.dll
windows10-2004-x64
1Netflix Ch...nt.dll
windows7-x64
1Netflix Ch...nt.dll
windows10-2004-x64
1Netflix Ch...et.dll
windows7-x64
1Netflix Ch...et.dll
windows10-2004-x64
1Netflix Ch...ix.exe
windows7-x64
7Netflix Ch...ix.exe
windows10-2004-x64
7Netflix Ch...x1.exe
windows7-x64
10Netflix Ch...x1.exe
windows10-2004-x64
10Netflix Ch...on.dll
windows7-x64
1Netflix Ch...on.dll
windows10-2004-x64
1Netflix Ch...on.dll
windows7-x64
1Netflix Ch...on.dll
windows10-2004-x64
1Netflix Ch...er.bat
windows7-x64
10Netflix Ch...er.bat
windows10-2004-x64
10Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 06:17
Behavioral task
behavioral1
Sample
Netflix Checker/Data/Jint.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Netflix Checker/Data/Jint.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Netflix Checker/Data/Leaf.xNet.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Netflix Checker/Data/Leaf.xNet.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Netflix Checker/Data/Modules/Jint.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
Netflix Checker/Data/Modules/Jint.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Netflix Checker/Data/Modules/Leaf.xNet.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
Netflix Checker/Data/Modules/Leaf.xNet.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Netflix Checker/Data/Modules/Netflix.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Netflix Checker/Data/Modules/Netflix.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Netflix Checker/Data/Modules/Netflix1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Netflix Checker/Data/Modules/Netflix1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Netflix Checker/Data/Modules/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Netflix Checker/Data/Modules/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Netflix Checker/Data/Newtonsoft.Json.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral16
Sample
Netflix Checker/Data/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Netflix Checker/Start Checker.bat
Resource
win7-20240903-en
windows7-x64
General
-
Target
Netflix Checker/Data/Modules/Netflix1.exe
-
Size
231KB
-
MD5
4d4914b127f4375b0c4ad1dd5dd99ff8
-
SHA1
153db21998c76d76c1f5d5f52f1f8f55b8f0b3ea
-
SHA256
f5ac145bb4853a5801cd13fb2f447384bd83f15b78494c025b4114386c2bf14d
-
SHA512
99a3860b040099077ad633bacc8115402ef36a737d2fa1c524b20b67651f0a5a0d4cb84f9cb3a35795196a1a78d3801b10f43abefe4810718e7077304e31cc42
-
SSDEEP
6144:xloZM+rIkd8g+EtXHkv/iD4nwkVpkqNlOjLWU1pANgI8e1mKhi:DoZtL+EP8nwkVpkqNlOjLWU1pAfA
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral11/memory/1984-1-0x0000000001230000-0x0000000001270000-memory.dmp family_umbral -
Umbral family
-
pid Process 2868 powershell.exe 2628 powershell.exe 1144 powershell.exe 2900 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Netflix1.exe -
Deletes itself 1 IoCs
pid Process 2200 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2200 cmd.exe 2176 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1388 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2176 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1984 Netflix1.exe 2900 powershell.exe 2868 powershell.exe 2628 powershell.exe 1784 powershell.exe 1144 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1984 Netflix1.exe Token: SeIncreaseQuotaPrivilege 3036 wmic.exe Token: SeSecurityPrivilege 3036 wmic.exe Token: SeTakeOwnershipPrivilege 3036 wmic.exe Token: SeLoadDriverPrivilege 3036 wmic.exe Token: SeSystemProfilePrivilege 3036 wmic.exe Token: SeSystemtimePrivilege 3036 wmic.exe Token: SeProfSingleProcessPrivilege 3036 wmic.exe Token: SeIncBasePriorityPrivilege 3036 wmic.exe Token: SeCreatePagefilePrivilege 3036 wmic.exe Token: SeBackupPrivilege 3036 wmic.exe Token: SeRestorePrivilege 3036 wmic.exe Token: SeShutdownPrivilege 3036 wmic.exe Token: SeDebugPrivilege 3036 wmic.exe Token: SeSystemEnvironmentPrivilege 3036 wmic.exe Token: SeRemoteShutdownPrivilege 3036 wmic.exe Token: SeUndockPrivilege 3036 wmic.exe Token: SeManageVolumePrivilege 3036 wmic.exe Token: 33 3036 wmic.exe Token: 34 3036 wmic.exe Token: 35 3036 wmic.exe Token: SeIncreaseQuotaPrivilege 3036 wmic.exe Token: SeSecurityPrivilege 3036 wmic.exe Token: SeTakeOwnershipPrivilege 3036 wmic.exe Token: SeLoadDriverPrivilege 3036 wmic.exe Token: SeSystemProfilePrivilege 3036 wmic.exe Token: SeSystemtimePrivilege 3036 wmic.exe Token: SeProfSingleProcessPrivilege 3036 wmic.exe Token: SeIncBasePriorityPrivilege 3036 wmic.exe Token: SeCreatePagefilePrivilege 3036 wmic.exe Token: SeBackupPrivilege 3036 wmic.exe Token: SeRestorePrivilege 3036 wmic.exe Token: SeShutdownPrivilege 3036 wmic.exe Token: SeDebugPrivilege 3036 wmic.exe Token: SeSystemEnvironmentPrivilege 3036 wmic.exe Token: SeRemoteShutdownPrivilege 3036 wmic.exe Token: SeUndockPrivilege 3036 wmic.exe Token: SeManageVolumePrivilege 3036 wmic.exe Token: 33 3036 wmic.exe Token: 34 3036 wmic.exe Token: 35 3036 wmic.exe Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 2628 powershell.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeIncreaseQuotaPrivilege 764 wmic.exe Token: SeSecurityPrivilege 764 wmic.exe Token: SeTakeOwnershipPrivilege 764 wmic.exe Token: SeLoadDriverPrivilege 764 wmic.exe Token: SeSystemProfilePrivilege 764 wmic.exe Token: SeSystemtimePrivilege 764 wmic.exe Token: SeProfSingleProcessPrivilege 764 wmic.exe Token: SeIncBasePriorityPrivilege 764 wmic.exe Token: SeCreatePagefilePrivilege 764 wmic.exe Token: SeBackupPrivilege 764 wmic.exe Token: SeRestorePrivilege 764 wmic.exe Token: SeShutdownPrivilege 764 wmic.exe Token: SeDebugPrivilege 764 wmic.exe Token: SeSystemEnvironmentPrivilege 764 wmic.exe Token: SeRemoteShutdownPrivilege 764 wmic.exe Token: SeUndockPrivilege 764 wmic.exe Token: SeManageVolumePrivilege 764 wmic.exe Token: 33 764 wmic.exe Token: 34 764 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1984 wrote to memory of 3036 1984 Netflix1.exe 31 PID 1984 wrote to memory of 3036 1984 Netflix1.exe 31 PID 1984 wrote to memory of 3036 1984 Netflix1.exe 31 PID 1984 wrote to memory of 2908 1984 Netflix1.exe 34 PID 1984 wrote to memory of 2908 1984 Netflix1.exe 34 PID 1984 wrote to memory of 2908 1984 Netflix1.exe 34 PID 1984 wrote to memory of 2900 1984 Netflix1.exe 36 PID 1984 wrote to memory of 2900 1984 Netflix1.exe 36 PID 1984 wrote to memory of 2900 1984 Netflix1.exe 36 PID 1984 wrote to memory of 2868 1984 Netflix1.exe 38 PID 1984 wrote to memory of 2868 1984 Netflix1.exe 38 PID 1984 wrote to memory of 2868 1984 Netflix1.exe 38 PID 1984 wrote to memory of 2628 1984 Netflix1.exe 40 PID 1984 wrote to memory of 2628 1984 Netflix1.exe 40 PID 1984 wrote to memory of 2628 1984 Netflix1.exe 40 PID 1984 wrote to memory of 1784 1984 Netflix1.exe 42 PID 1984 wrote to memory of 1784 1984 Netflix1.exe 42 PID 1984 wrote to memory of 1784 1984 Netflix1.exe 42 PID 1984 wrote to memory of 764 1984 Netflix1.exe 44 PID 1984 wrote to memory of 764 1984 Netflix1.exe 44 PID 1984 wrote to memory of 764 1984 Netflix1.exe 44 PID 1984 wrote to memory of 1512 1984 Netflix1.exe 46 PID 1984 wrote to memory of 1512 1984 Netflix1.exe 46 PID 1984 wrote to memory of 1512 1984 Netflix1.exe 46 PID 1984 wrote to memory of 768 1984 Netflix1.exe 48 PID 1984 wrote to memory of 768 1984 Netflix1.exe 48 PID 1984 wrote to memory of 768 1984 Netflix1.exe 48 PID 1984 wrote to memory of 1144 1984 Netflix1.exe 50 PID 1984 wrote to memory of 1144 1984 Netflix1.exe 50 PID 1984 wrote to memory of 1144 1984 Netflix1.exe 50 PID 1984 wrote to memory of 1388 1984 Netflix1.exe 52 PID 1984 wrote to memory of 1388 1984 Netflix1.exe 52 PID 1984 wrote to memory of 1388 1984 Netflix1.exe 52 PID 1984 wrote to memory of 2200 1984 Netflix1.exe 54 PID 1984 wrote to memory of 2200 1984 Netflix1.exe 54 PID 1984 wrote to memory of 2200 1984 Netflix1.exe 54 PID 2200 wrote to memory of 2176 2200 cmd.exe 56 PID 2200 wrote to memory of 2176 2200 cmd.exe 56 PID 2200 wrote to memory of 2176 2200 cmd.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2908 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"2⤵
- Views/modifies file attributes
PID:2908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1512
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1144
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1388
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2176
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56a917795d1cccbb7b0abd553fe7566bb
SHA13cb0f1615da5b836365e52634dd2a0259f769c49
SHA2562b4c52a740a7ab55fcd92bf0c6bcb449d022ce316c9a49bcbeab4118448bb2c7
SHA512fe170e26d1cbbcf76a9bcb6737cb30f04a2f3b075953a3a1f371de7db7b161546afeaa876cdb7beb5b8cd22159ad21422758218011d8d7cdfdd58a6c2b533f8e