Overview
overview
10Static
static
10Netflix Ch...nt.dll
windows7-x64
1Netflix Ch...nt.dll
windows10-2004-x64
1Netflix Ch...et.dll
windows7-x64
1Netflix Ch...et.dll
windows10-2004-x64
1Netflix Ch...nt.dll
windows7-x64
1Netflix Ch...nt.dll
windows10-2004-x64
1Netflix Ch...et.dll
windows7-x64
1Netflix Ch...et.dll
windows10-2004-x64
1Netflix Ch...ix.exe
windows7-x64
7Netflix Ch...ix.exe
windows10-2004-x64
7Netflix Ch...x1.exe
windows7-x64
10Netflix Ch...x1.exe
windows10-2004-x64
10Netflix Ch...on.dll
windows7-x64
1Netflix Ch...on.dll
windows10-2004-x64
1Netflix Ch...on.dll
windows7-x64
1Netflix Ch...on.dll
windows10-2004-x64
1Netflix Ch...er.bat
windows7-x64
10Netflix Ch...er.bat
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 13:54
Behavioral task
behavioral1
Sample
Netflix Checker/Data/Jint.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Netflix Checker/Data/Jint.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Netflix Checker/Data/Leaf.xNet.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Netflix Checker/Data/Leaf.xNet.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Netflix Checker/Data/Modules/Jint.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
Netflix Checker/Data/Modules/Jint.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Netflix Checker/Data/Modules/Leaf.xNet.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Netflix Checker/Data/Modules/Leaf.xNet.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Netflix Checker/Data/Modules/Netflix.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Netflix Checker/Data/Modules/Netflix.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Netflix Checker/Data/Modules/Netflix1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Netflix Checker/Data/Modules/Netflix1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Netflix Checker/Data/Modules/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Netflix Checker/Data/Modules/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Netflix Checker/Data/Newtonsoft.Json.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral16
Sample
Netflix Checker/Data/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Netflix Checker/Start Checker.bat
Resource
win7-20240708-en
windows7-x64
General
-
Target
Netflix Checker/Data/Modules/Netflix1.exe
-
Size
231KB
-
MD5
4d4914b127f4375b0c4ad1dd5dd99ff8
-
SHA1
153db21998c76d76c1f5d5f52f1f8f55b8f0b3ea
-
SHA256
f5ac145bb4853a5801cd13fb2f447384bd83f15b78494c025b4114386c2bf14d
-
SHA512
99a3860b040099077ad633bacc8115402ef36a737d2fa1c524b20b67651f0a5a0d4cb84f9cb3a35795196a1a78d3801b10f43abefe4810718e7077304e31cc42
-
SSDEEP
6144:xloZM+rIkd8g+EtXHkv/iD4nwkVpkqNlOjLWU1pANgI8e1mKhi:DoZtL+EP8nwkVpkqNlOjLWU1pAfA
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral11/memory/2692-1-0x0000000000040000-0x0000000000080000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2876 powershell.exe 2856 powershell.exe 1604 powershell.exe 1376 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Netflix1.exe -
Deletes itself 1 IoCs
pid Process 1380 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 11 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1380 cmd.exe 1776 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2528 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1776 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2692 Netflix1.exe 2876 powershell.exe 1376 powershell.exe 2856 powershell.exe 592 powershell.exe 1604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2692 Netflix1.exe Token: SeIncreaseQuotaPrivilege 576 wmic.exe Token: SeSecurityPrivilege 576 wmic.exe Token: SeTakeOwnershipPrivilege 576 wmic.exe Token: SeLoadDriverPrivilege 576 wmic.exe Token: SeSystemProfilePrivilege 576 wmic.exe Token: SeSystemtimePrivilege 576 wmic.exe Token: SeProfSingleProcessPrivilege 576 wmic.exe Token: SeIncBasePriorityPrivilege 576 wmic.exe Token: SeCreatePagefilePrivilege 576 wmic.exe Token: SeBackupPrivilege 576 wmic.exe Token: SeRestorePrivilege 576 wmic.exe Token: SeShutdownPrivilege 576 wmic.exe Token: SeDebugPrivilege 576 wmic.exe Token: SeSystemEnvironmentPrivilege 576 wmic.exe Token: SeRemoteShutdownPrivilege 576 wmic.exe Token: SeUndockPrivilege 576 wmic.exe Token: SeManageVolumePrivilege 576 wmic.exe Token: 33 576 wmic.exe Token: 34 576 wmic.exe Token: 35 576 wmic.exe Token: SeIncreaseQuotaPrivilege 576 wmic.exe Token: SeSecurityPrivilege 576 wmic.exe Token: SeTakeOwnershipPrivilege 576 wmic.exe Token: SeLoadDriverPrivilege 576 wmic.exe Token: SeSystemProfilePrivilege 576 wmic.exe Token: SeSystemtimePrivilege 576 wmic.exe Token: SeProfSingleProcessPrivilege 576 wmic.exe Token: SeIncBasePriorityPrivilege 576 wmic.exe Token: SeCreatePagefilePrivilege 576 wmic.exe Token: SeBackupPrivilege 576 wmic.exe Token: SeRestorePrivilege 576 wmic.exe Token: SeShutdownPrivilege 576 wmic.exe Token: SeDebugPrivilege 576 wmic.exe Token: SeSystemEnvironmentPrivilege 576 wmic.exe Token: SeRemoteShutdownPrivilege 576 wmic.exe Token: SeUndockPrivilege 576 wmic.exe Token: SeManageVolumePrivilege 576 wmic.exe Token: 33 576 wmic.exe Token: 34 576 wmic.exe Token: 35 576 wmic.exe Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 1376 powershell.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeDebugPrivilege 592 powershell.exe Token: SeIncreaseQuotaPrivilege 1200 wmic.exe Token: SeSecurityPrivilege 1200 wmic.exe Token: SeTakeOwnershipPrivilege 1200 wmic.exe Token: SeLoadDriverPrivilege 1200 wmic.exe Token: SeSystemProfilePrivilege 1200 wmic.exe Token: SeSystemtimePrivilege 1200 wmic.exe Token: SeProfSingleProcessPrivilege 1200 wmic.exe Token: SeIncBasePriorityPrivilege 1200 wmic.exe Token: SeCreatePagefilePrivilege 1200 wmic.exe Token: SeBackupPrivilege 1200 wmic.exe Token: SeRestorePrivilege 1200 wmic.exe Token: SeShutdownPrivilege 1200 wmic.exe Token: SeDebugPrivilege 1200 wmic.exe Token: SeSystemEnvironmentPrivilege 1200 wmic.exe Token: SeRemoteShutdownPrivilege 1200 wmic.exe Token: SeUndockPrivilege 1200 wmic.exe Token: SeManageVolumePrivilege 1200 wmic.exe Token: 33 1200 wmic.exe Token: 34 1200 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2692 wrote to memory of 576 2692 Netflix1.exe 30 PID 2692 wrote to memory of 576 2692 Netflix1.exe 30 PID 2692 wrote to memory of 576 2692 Netflix1.exe 30 PID 2692 wrote to memory of 1648 2692 Netflix1.exe 33 PID 2692 wrote to memory of 1648 2692 Netflix1.exe 33 PID 2692 wrote to memory of 1648 2692 Netflix1.exe 33 PID 2692 wrote to memory of 2876 2692 Netflix1.exe 35 PID 2692 wrote to memory of 2876 2692 Netflix1.exe 35 PID 2692 wrote to memory of 2876 2692 Netflix1.exe 35 PID 2692 wrote to memory of 1376 2692 Netflix1.exe 37 PID 2692 wrote to memory of 1376 2692 Netflix1.exe 37 PID 2692 wrote to memory of 1376 2692 Netflix1.exe 37 PID 2692 wrote to memory of 2856 2692 Netflix1.exe 39 PID 2692 wrote to memory of 2856 2692 Netflix1.exe 39 PID 2692 wrote to memory of 2856 2692 Netflix1.exe 39 PID 2692 wrote to memory of 592 2692 Netflix1.exe 41 PID 2692 wrote to memory of 592 2692 Netflix1.exe 41 PID 2692 wrote to memory of 592 2692 Netflix1.exe 41 PID 2692 wrote to memory of 1200 2692 Netflix1.exe 43 PID 2692 wrote to memory of 1200 2692 Netflix1.exe 43 PID 2692 wrote to memory of 1200 2692 Netflix1.exe 43 PID 2692 wrote to memory of 2100 2692 Netflix1.exe 45 PID 2692 wrote to memory of 2100 2692 Netflix1.exe 45 PID 2692 wrote to memory of 2100 2692 Netflix1.exe 45 PID 2692 wrote to memory of 1960 2692 Netflix1.exe 47 PID 2692 wrote to memory of 1960 2692 Netflix1.exe 47 PID 2692 wrote to memory of 1960 2692 Netflix1.exe 47 PID 2692 wrote to memory of 1604 2692 Netflix1.exe 49 PID 2692 wrote to memory of 1604 2692 Netflix1.exe 49 PID 2692 wrote to memory of 1604 2692 Netflix1.exe 49 PID 2692 wrote to memory of 2528 2692 Netflix1.exe 51 PID 2692 wrote to memory of 2528 2692 Netflix1.exe 51 PID 2692 wrote to memory of 2528 2692 Netflix1.exe 51 PID 2692 wrote to memory of 1380 2692 Netflix1.exe 53 PID 2692 wrote to memory of 1380 2692 Netflix1.exe 53 PID 2692 wrote to memory of 1380 2692 Netflix1.exe 53 PID 1380 wrote to memory of 1776 1380 cmd.exe 55 PID 1380 wrote to memory of 1776 1380 cmd.exe 55 PID 1380 wrote to memory of 1776 1380 cmd.exe 55 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1648 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"2⤵
- Views/modifies file attributes
PID:1648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2100
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2528
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1776
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5535b12327d0f6028ea81bd85fbb0fa03
SHA184a4b0e4d2059b4046512eed6359d11edeac10c5
SHA25600e84bd1e5e8f82e26f0951e5c6fcaf73178363999482619598740a1c02606d1
SHA512e37750df7e896dc478f63c259ffc3427dbcdf70fd285c0033039b51bb499a87bd55799031c645e609daabe291be75e26de0c757db0a7ce4437d0f74d82a2417b