Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 09:51
Static task
static1
Behavioral task
behavioral1
Sample
Slinky/load.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Slinky/load.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Slinky/slinky_library.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Slinky/slinky_library.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Slinky/slinkyhook.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Slinky/slinkyhook.dll
Resource
win10v2004-20241007-en
General
-
Target
Slinky/load.exe
-
Size
17.6MB
-
MD5
fe9f1266ea6a28f18c8165e625d3f9ce
-
SHA1
99ef957f3eb31480257be461ebebc200f5018b94
-
SHA256
6808d24ab0ea5dbafec1ef8bc5b01421aeb1f9817972bc6df415ed935461de61
-
SHA512
fabe0e4d25bb2bd74dcf2ea71dd5163b87a117cd28809bd05ebc8ad08bfcf4682236fb980a6e5affd0c8737acae1b7c0f14ed01bc734c273660c8b0c7038eb82
-
SSDEEP
393216:YQtOfDiM8m+J6/lSZRNw2nuNS3NzOZRumEJyb6BF0j6bxPJCX:DO+2/UZRN0QdzOZAmEGGj1PJCX
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/files/0x0009000000023cb1-7.dat family_umbral behavioral2/memory/3980-14-0x000001EB66700000-0x000001EB66740000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2760 powershell.exe 4228 powershell.exe 4084 powershell.exe 3020 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Slinky Injector.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation load.exe -
Executes dropped EXE 2 IoCs
pid Process 3980 Slinky Injector.exe 4396 load.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 23 discord.com 24 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2268 wmic.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4396 load.exe 4396 load.exe 3980 Slinky Injector.exe 4396 load.exe 4396 load.exe 2760 powershell.exe 2760 powershell.exe 4228 powershell.exe 4228 powershell.exe 4396 load.exe 4396 load.exe 4084 powershell.exe 4084 powershell.exe 1876 powershell.exe 1876 powershell.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 3020 powershell.exe 3020 powershell.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe 4396 load.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3980 Slinky Injector.exe Token: SeIncreaseQuotaPrivilege 3820 wmic.exe Token: SeSecurityPrivilege 3820 wmic.exe Token: SeTakeOwnershipPrivilege 3820 wmic.exe Token: SeLoadDriverPrivilege 3820 wmic.exe Token: SeSystemProfilePrivilege 3820 wmic.exe Token: SeSystemtimePrivilege 3820 wmic.exe Token: SeProfSingleProcessPrivilege 3820 wmic.exe Token: SeIncBasePriorityPrivilege 3820 wmic.exe Token: SeCreatePagefilePrivilege 3820 wmic.exe Token: SeBackupPrivilege 3820 wmic.exe Token: SeRestorePrivilege 3820 wmic.exe Token: SeShutdownPrivilege 3820 wmic.exe Token: SeDebugPrivilege 3820 wmic.exe Token: SeSystemEnvironmentPrivilege 3820 wmic.exe Token: SeRemoteShutdownPrivilege 3820 wmic.exe Token: SeUndockPrivilege 3820 wmic.exe Token: SeManageVolumePrivilege 3820 wmic.exe Token: 33 3820 wmic.exe Token: 34 3820 wmic.exe Token: 35 3820 wmic.exe Token: 36 3820 wmic.exe Token: SeIncreaseQuotaPrivilege 3820 wmic.exe Token: SeSecurityPrivilege 3820 wmic.exe Token: SeTakeOwnershipPrivilege 3820 wmic.exe Token: SeLoadDriverPrivilege 3820 wmic.exe Token: SeSystemProfilePrivilege 3820 wmic.exe Token: SeSystemtimePrivilege 3820 wmic.exe Token: SeProfSingleProcessPrivilege 3820 wmic.exe Token: SeIncBasePriorityPrivilege 3820 wmic.exe Token: SeCreatePagefilePrivilege 3820 wmic.exe Token: SeBackupPrivilege 3820 wmic.exe Token: SeRestorePrivilege 3820 wmic.exe Token: SeShutdownPrivilege 3820 wmic.exe Token: SeDebugPrivilege 3820 wmic.exe Token: SeSystemEnvironmentPrivilege 3820 wmic.exe Token: SeRemoteShutdownPrivilege 3820 wmic.exe Token: SeUndockPrivilege 3820 wmic.exe Token: SeManageVolumePrivilege 3820 wmic.exe Token: 33 3820 wmic.exe Token: 34 3820 wmic.exe Token: 35 3820 wmic.exe Token: 36 3820 wmic.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 4228 powershell.exe Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 1876 powershell.exe Token: SeIncreaseQuotaPrivilege 4388 wmic.exe Token: SeSecurityPrivilege 4388 wmic.exe Token: SeTakeOwnershipPrivilege 4388 wmic.exe Token: SeLoadDriverPrivilege 4388 wmic.exe Token: SeSystemProfilePrivilege 4388 wmic.exe Token: SeSystemtimePrivilege 4388 wmic.exe Token: SeProfSingleProcessPrivilege 4388 wmic.exe Token: SeIncBasePriorityPrivilege 4388 wmic.exe Token: SeCreatePagefilePrivilege 4388 wmic.exe Token: SeBackupPrivilege 4388 wmic.exe Token: SeRestorePrivilege 4388 wmic.exe Token: SeShutdownPrivilege 4388 wmic.exe Token: SeDebugPrivilege 4388 wmic.exe Token: SeSystemEnvironmentPrivilege 4388 wmic.exe Token: SeRemoteShutdownPrivilege 4388 wmic.exe Token: SeUndockPrivilege 4388 wmic.exe Token: SeManageVolumePrivilege 4388 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4204 wrote to memory of 3980 4204 load.exe 83 PID 4204 wrote to memory of 3980 4204 load.exe 83 PID 3980 wrote to memory of 3820 3980 Slinky Injector.exe 85 PID 3980 wrote to memory of 3820 3980 Slinky Injector.exe 85 PID 4204 wrote to memory of 4396 4204 load.exe 87 PID 4204 wrote to memory of 4396 4204 load.exe 87 PID 3980 wrote to memory of 2760 3980 Slinky Injector.exe 92 PID 3980 wrote to memory of 2760 3980 Slinky Injector.exe 92 PID 3980 wrote to memory of 4228 3980 Slinky Injector.exe 94 PID 3980 wrote to memory of 4228 3980 Slinky Injector.exe 94 PID 3980 wrote to memory of 4084 3980 Slinky Injector.exe 98 PID 3980 wrote to memory of 4084 3980 Slinky Injector.exe 98 PID 3980 wrote to memory of 1876 3980 Slinky Injector.exe 100 PID 3980 wrote to memory of 1876 3980 Slinky Injector.exe 100 PID 3980 wrote to memory of 4388 3980 Slinky Injector.exe 102 PID 3980 wrote to memory of 4388 3980 Slinky Injector.exe 102 PID 3980 wrote to memory of 868 3980 Slinky Injector.exe 104 PID 3980 wrote to memory of 868 3980 Slinky Injector.exe 104 PID 3980 wrote to memory of 4760 3980 Slinky Injector.exe 106 PID 3980 wrote to memory of 4760 3980 Slinky Injector.exe 106 PID 3980 wrote to memory of 3020 3980 Slinky Injector.exe 108 PID 3980 wrote to memory of 3020 3980 Slinky Injector.exe 108 PID 3980 wrote to memory of 2268 3980 Slinky Injector.exe 110 PID 3980 wrote to memory of 2268 3980 Slinky Injector.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\Slinky\load.exe"C:\Users\Admin\AppData\Local\Temp\Slinky\load.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe"C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:868
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:4760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3020
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2268
-
-
-
C:\Users\Admin\AppData\Local\Temp\load.exe"C:\Users\Admin\AppData\Local\Temp\load.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD52984662ba3f86d7fcf26758b5b76754d
SHA1bc2a43ffd898222ee84406313f3834f226928379
SHA256f0815f797b0c1829745dd65985f28d459688f91ceb2f3d76fed2d4309589bcde
SHA512a06251a7a14559ebf5627a3c6b03fda9ded1d4ee44991283c824ccf5011cdf67665696d2d9b23507cbb3e3b9943b9e9f79ef28d3657eb61fb99920225417ab11
-
Filesize
944B
MD5cb3a799921d48256ab45414af88b0aa8
SHA18888fb5656f5f11576c0fbc3ba45d7df56000d28
SHA2565ad60a0e324106c6b5a8a7c41b4eac83234ed53cf26025dd4d63c0750b265105
SHA51221b53b49d0f95cb600444b15a274c31d9374ae96dc2ab464e6ada96bae11f1000e92f6f51f62e5b91891dbbb30e6ab9c71006a9a166b8d4ae24457dcd7efdf69
-
Filesize
948B
MD574a6b79d36b4aae8b027a218bc6e1af7
SHA10350e46c1df6934903c4820a00b0bc4721779e5f
SHA25660c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
SHA51260e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0
-
Filesize
1KB
MD5227556da5e65f6819f477756808c17e4
SHA16ffce766e881ca2a60180bb25f4981b183f78279
SHA256101f5fe8a4192f14e9f0a12c105ca81c9f176860930af44747185dd1bedb59a4
SHA512d46b935809d2c4b7a041ad790f2db11c0a808df022c91ae9152b8769021b884fde49653a7a46557ef9ee65e274fe0b6c8503df9b50e6b3b849fefacf51f8bd6a
-
Filesize
228KB
MD522c66a144f89f219d9f7bef81578dd48
SHA1ad7235aadd9583fd423a5f36a5c65a6213d23fff
SHA2569c1f1a7105e258fc4b5df94ba02bd41ddbe55bc82c88cd718fa5b2fac5969f00
SHA51278316d05a92f3c4d9be0f18d1bbc86529961917d83cb00de36a396e96b2357564e354e9cfdc364f08d7e96bdd8602296e6df6eb0d2ea21029c7a45e116edb7a0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
18.4MB
MD538019371c7cfc54d0c08629da0384a1f
SHA187509b8aa5549f22b53362588c624b010cfa5b26
SHA256d4f6bfde46ea2394570619fa89f8cdc8ac00b297179fe8831558530ec48492f1
SHA51275f204fa1be253a68678ec7a6637a8db1b02346fb429365500427e493fd0c2b2d2b24a4ae30de3f777c239af507c141f979b6012c8b394f663d073f2850d682d