Overview

overview

10

Static

static

10

94a9aea0d5...e8.exe

windows7-x64

10

94a9aea0d5...e8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 19:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    94a9aea0d58aed1c57e0f3857ea7de65778a6faab1912e4decbe463bf7b85ae8.exe

  • Size

    1.9MB

  • MD5

    477ee009f176249987f15c8fd01902f0

  • SHA1

    c40e6e81adcca5bf643ea005e3e2bc062793985d

  • SHA256

    94a9aea0d58aed1c57e0f3857ea7de65778a6faab1912e4decbe463bf7b85ae8

  • SHA512

    aef7538f615ec5607f56f41f17ad045a4ac8bba6e7a27e185068208a7ea704c01b1b87aaae0b5cb42f2e61ee11dd344e01c2f8d2d089a026e14931935da6dfef

  • SSDEEP

    24576:IRDdNQlDWcG0ZbOOdezYwITkHiPIZp7WAvck0poRtf0BJngtcp90kcTFI8A+W4+u:IRDTQRzMKeEcHLZkA0ruJd/

Score
10/10
umbralxwormdiscoveryevasionexecutionratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

were-breeding.gl.at.ply.gg:1234

Mutex

ecqG44OAn0ybERsL

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\94a9aea0d58aed1c57e0f3857ea7de65778a6faab1912e4decbe463bf7b85ae8.exe
    "C:\Users\Admin\AppData\Local\Temp\94a9aea0d58aed1c57e0f3857ea7de65778a6faab1912e4decbe463bf7b85ae8.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\Temp\KNA SERVICE.EXE
      "C:\Users\Admin\AppData\Local\Temp\KNA SERVICE.EXE"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1612
    • C:\Users\Admin\AppData\Local\Temp\RUN ME.EXE
      "C:\Users\Admin\AppData\Local\Temp\RUN ME.EXE"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RUN ME.EXE'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RUN ME.EXE'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1492
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows defender control'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows defender control'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3664
    • C:\Users\Admin\AppData\Local\Temp\SSS.EXE
      "C:\Users\Admin\AppData\Local\Temp\SSS.EXE"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3868
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
      • C:\Windows\SYSTEM32\attrib.exe
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\SSS.EXE"
        3⤵
        • Views/modifies file attributes
        PID:3644
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SSS.EXE'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4612
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:916
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:852
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:2944
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:3424
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5072
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:3148
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\SSS.EXE" && pause
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:700
            • C:\Windows\system32\PING.EXE
              ping localhost
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:4712

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Privilege Escalation

      Defense Evasion

      Hide Artifacts

      1
      T1564

      Hidden Files and Directories

      1
      T1564.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      5
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      5
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Web Service

      1
      T1102

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        276798eeb29a49dc6e199768bc9c2e71

        SHA1

        5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

        SHA256

        cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

        SHA512

        0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        d194c5fef9a9bd80df293476ae23ee88

        SHA1

        10ad7c44f4d970247d27eb7dc87623db5ed2ad86

        SHA256

        3e4c4457e7b15372930a42307ab6e0c3744c1e0be6dfe120b8292e13387f15e6

        SHA512

        0937d3014485a45a314818545c64aac98542b7d0bfab751a98d3b30b399a6e25e6a07fa11d51c691a0e0e34af4b114c21d9955ab4a22abcce928ff38616deb4e

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        470a31aac9cf705179e47a32ce51f121

        SHA1

        757fc377e0198cae813c99f4d63e29d2a82ec1ec

        SHA256

        cf69cc666c1919e86261080d13dedb0301387c99f3360b674e211bce4071c80c

        SHA512

        5e667ce8238d0c2b6453b3f34757083cda67834c121ac5726e13bcd7689add07d410b67f5227bb9f9e79f6540e8579ff82e95323243905f825c9d7cf8a05cc1b

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        d8cb3e9459807e35f02130fad3f9860d

        SHA1

        5af7f32cb8a30e850892b15e9164030a041f4bd6

        SHA256

        2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

        SHA512

        045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        6d42b6da621e8df5674e26b799c8e2aa

        SHA1

        ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

        SHA256

        5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

        SHA512

        53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        948B

        MD5

        c65738617888921a153bd9b1ef516ee7

        SHA1

        5245e71ea3c181d76320c857b639272ac9e079b1

        SHA256

        4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26

        SHA512

        2e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\KNA SERVICE.EXE
        Filesize

        1.5MB

        MD5

        d3fbde93141444735fb5ea06e1371213

        SHA1

        f25eed8c6bf09ba4b1ce60b6ee72d5e36bf9a4f2

        SHA256

        ed8b9422f74d4dc9ec9a55cabedc04c819a13eaeba5b7ddade5e3d5200337816

        SHA512

        553ee6d8ac6d2faa55b0bbb5b97d1ac7cad0dfb1ebf8e2e30f87c881478309a4e0ed0f98285b334ad244be2243ee2b067cb267ce5054ca119d34ae224df65e31

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RUN ME.EXE
        Filesize

        38KB

        MD5

        816ae2a8f7799541016e947b09286035

        SHA1

        c34cf31168b08a7ae66cafbbbd5570d7d72cab2b

        SHA256

        75a03d5602e8eab0d7013319781dd0b44133fffb50ad5783b5d8224a63265e6d

        SHA512

        7d76cb89386c998e922e38507a931daf4e62a335ff5f1bb9731efd0c1a279efa1ee51bb424f8089b1019dceb2121d379a3f1ef5ab00163a13df6f3efd571039e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\SSS.EXE
        Filesize

        229KB

        MD5

        482265beef9bef7b8def0d9e793a8470

        SHA1

        6de3fb6bef13732a226f3b4bcde1c4f8f0b79881

        SHA256

        1da02f46310578bf95267665f964c6c79617e6fd5f3926c53aad40529782750e

        SHA512

        6c6c5d528243895426e7d04ab4fb9af2ce54c7286f25a602e793a034692035c86f832548149d24eee5ce4e4d7f77347361e8ebfe972eb9a826245cff0b7dac8c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lboldv5n.0sp.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/1612-48-0x0000000008C20000-0x0000000008C2E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1612-42-0x0000000006760000-0x0000000006772000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1612-44-0x00000000072C0000-0x00000000072FC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/1612-45-0x0000000008BA0000-0x0000000008BA8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1612-47-0x000000000AE30000-0x000000000AE68000-memory.dmp

        Filesize

        224KB

        Download

      • memory/1612-41-0x0000000005FC0000-0x0000000006564000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1612-40-0x00000000058A0000-0x0000000005906000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1612-183-0x0000000073C2E000-0x0000000073C2F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1612-39-0x0000000005510000-0x000000000567A000-memory.dmp

        Filesize

        1.4MB

        Download

      • memory/1612-36-0x0000000000A30000-0x0000000000BC2000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/1612-38-0x0000000073C2E000-0x0000000073C2F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3868-75-0x00000217FF4F0000-0x00000217FF540000-memory.dmp

        Filesize

        320KB

        Download

      • memory/3868-76-0x00000217FF4A0000-0x00000217FF4BE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/3868-74-0x00000217FF570000-0x00000217FF5E6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/3868-37-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3868-35-0x00000217FF110000-0x00000217FF150000-memory.dmp

        Filesize

        256KB

        Download

      • memory/3868-146-0x00000217FF440000-0x00000217FF44A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3868-147-0x00000217FF540000-0x00000217FF552000-memory.dmp

        Filesize

        72KB

        Download

      • memory/3868-182-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4544-34-0x0000000000220000-0x0000000000230000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4544-30-0x00007FFA102C3000-0x00007FFA102C5000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4544-175-0x000000001B080000-0x000000001B090000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4544-184-0x000000001B080000-0x000000001B090000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4612-46-0x000001F37FEF0000-0x000001F37FF12000-memory.dmp

        Filesize

        136KB

        Download