Analysis
-
max time kernel
95s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:21
General
-
Target
citizen.exe
-
Size
231KB
-
MD5
8fcef0c1c33c1f00b585f79e484a63fa
-
SHA1
57eaedd0de6fc7b965a6b132cf23380076e63336
-
SHA256
dc2a8b1f1aec321b087018c6177a9a6478d3ee10b04ef0ed525e3b33206ea3fc
-
SHA512
ab422374c0f26ce2834b3738d7c4611f214ebb7090f98b7aa92bc1a7a273ead93186013268b5c15878f0df9c075c870ff9648001efc3f9ec03951d83df820fb0
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD42i6kgGhZqLfiQBFUAjb8e1mAi:joZtL+EP82i6kgGhZqLfiQBFU+e
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4184-1-0x00000161EBBC0000-0x00000161EBC00000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1820 powershell.exe 4680 powershell.exe 3192 powershell.exe 4040 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts citizen.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 23 discord.com 24 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5092 cmd.exe 812 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4128 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 812 PING.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4184 citizen.exe 1820 powershell.exe 1820 powershell.exe 4680 powershell.exe 4680 powershell.exe 3192 powershell.exe 3192 powershell.exe 3884 powershell.exe 3884 powershell.exe 4040 powershell.exe 4040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4184 citizen.exe Token: SeIncreaseQuotaPrivilege 5008 wmic.exe Token: SeSecurityPrivilege 5008 wmic.exe Token: SeTakeOwnershipPrivilege 5008 wmic.exe Token: SeLoadDriverPrivilege 5008 wmic.exe Token: SeSystemProfilePrivilege 5008 wmic.exe Token: SeSystemtimePrivilege 5008 wmic.exe Token: SeProfSingleProcessPrivilege 5008 wmic.exe Token: SeIncBasePriorityPrivilege 5008 wmic.exe Token: SeCreatePagefilePrivilege 5008 wmic.exe Token: SeBackupPrivilege 5008 wmic.exe Token: SeRestorePrivilege 5008 wmic.exe Token: SeShutdownPrivilege 5008 wmic.exe Token: SeDebugPrivilege 5008 wmic.exe Token: SeSystemEnvironmentPrivilege 5008 wmic.exe Token: SeRemoteShutdownPrivilege 5008 wmic.exe Token: SeUndockPrivilege 5008 wmic.exe Token: SeManageVolumePrivilege 5008 wmic.exe Token: 33 5008 wmic.exe Token: 34 5008 wmic.exe Token: 35 5008 wmic.exe Token: 36 5008 wmic.exe Token: SeIncreaseQuotaPrivilege 5008 wmic.exe Token: SeSecurityPrivilege 5008 wmic.exe Token: SeTakeOwnershipPrivilege 5008 wmic.exe Token: SeLoadDriverPrivilege 5008 wmic.exe Token: SeSystemProfilePrivilege 5008 wmic.exe Token: SeSystemtimePrivilege 5008 wmic.exe Token: SeProfSingleProcessPrivilege 5008 wmic.exe Token: SeIncBasePriorityPrivilege 5008 wmic.exe Token: SeCreatePagefilePrivilege 5008 wmic.exe Token: SeBackupPrivilege 5008 wmic.exe Token: SeRestorePrivilege 5008 wmic.exe Token: SeShutdownPrivilege 5008 wmic.exe Token: SeDebugPrivilege 5008 wmic.exe Token: SeSystemEnvironmentPrivilege 5008 wmic.exe Token: SeRemoteShutdownPrivilege 5008 wmic.exe Token: SeUndockPrivilege 5008 wmic.exe Token: SeManageVolumePrivilege 5008 wmic.exe Token: 33 5008 wmic.exe Token: 34 5008 wmic.exe Token: 35 5008 wmic.exe Token: 36 5008 wmic.exe Token: SeDebugPrivilege 1820 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 3884 powershell.exe Token: SeIncreaseQuotaPrivilege 3228 wmic.exe Token: SeSecurityPrivilege 3228 wmic.exe Token: SeTakeOwnershipPrivilege 3228 wmic.exe Token: SeLoadDriverPrivilege 3228 wmic.exe Token: SeSystemProfilePrivilege 3228 wmic.exe Token: SeSystemtimePrivilege 3228 wmic.exe Token: SeProfSingleProcessPrivilege 3228 wmic.exe Token: SeIncBasePriorityPrivilege 3228 wmic.exe Token: SeCreatePagefilePrivilege 3228 wmic.exe Token: SeBackupPrivilege 3228 wmic.exe Token: SeRestorePrivilege 3228 wmic.exe Token: SeShutdownPrivilege 3228 wmic.exe Token: SeDebugPrivilege 3228 wmic.exe Token: SeSystemEnvironmentPrivilege 3228 wmic.exe Token: SeRemoteShutdownPrivilege 3228 wmic.exe Token: SeUndockPrivilege 3228 wmic.exe Token: SeManageVolumePrivilege 3228 wmic.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4184 wrote to memory of 5008 4184 citizen.exe 83 PID 4184 wrote to memory of 5008 4184 citizen.exe 83 PID 4184 wrote to memory of 1380 4184 citizen.exe 86 PID 4184 wrote to memory of 1380 4184 citizen.exe 86 PID 4184 wrote to memory of 1820 4184 citizen.exe 88 PID 4184 wrote to memory of 1820 4184 citizen.exe 88 PID 4184 wrote to memory of 4680 4184 citizen.exe 90 PID 4184 wrote to memory of 4680 4184 citizen.exe 90 PID 4184 wrote to memory of 3192 4184 citizen.exe 92 PID 4184 wrote to memory of 3192 4184 citizen.exe 92 PID 4184 wrote to memory of 3884 4184 citizen.exe 94 PID 4184 wrote to memory of 3884 4184 citizen.exe 94 PID 4184 wrote to memory of 3228 4184 citizen.exe 96 PID 4184 wrote to memory of 3228 4184 citizen.exe 96 PID 4184 wrote to memory of 3032 4184 citizen.exe 98 PID 4184 wrote to memory of 3032 4184 citizen.exe 98 PID 4184 wrote to memory of 4192 4184 citizen.exe 100 PID 4184 wrote to memory of 4192 4184 citizen.exe 100 PID 4184 wrote to memory of 4040 4184 citizen.exe 102 PID 4184 wrote to memory of 4040 4184 citizen.exe 102 PID 4184 wrote to memory of 4128 4184 citizen.exe 104 PID 4184 wrote to memory of 4128 4184 citizen.exe 104 PID 4184 wrote to memory of 5092 4184 citizen.exe 106 PID 4184 wrote to memory of 5092 4184 citizen.exe 106 PID 5092 wrote to memory of 812 5092 cmd.exe 108 PID 5092 wrote to memory of 812 5092 cmd.exe 108 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1380 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\citizen.exe"C:\Users\Admin\AppData\Local\Temp\citizen.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\citizen.exe"2⤵
- Views/modifies file attributes
PID:1380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\citizen.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:3032
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:4192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:4128
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\citizen.exe" && pause2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:812
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD574a6b79d36b4aae8b027a218bc6e1af7
SHA10350e46c1df6934903c4820a00b0bc4721779e5f
SHA25660c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
SHA51260e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD56317adf4fbc43ea2fd68861fafd57155
SHA16b87c718893c83c6eed2767e8d9cbc6443e31913
SHA256c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af
SHA51217229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82