Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2024 09:51

General

  • Target

    Slinky/load.exe

  • Size

    17.6MB

  • MD5

    fe9f1266ea6a28f18c8165e625d3f9ce

  • SHA1

    99ef957f3eb31480257be461ebebc200f5018b94

  • SHA256

    6808d24ab0ea5dbafec1ef8bc5b01421aeb1f9817972bc6df415ed935461de61

  • SHA512

    fabe0e4d25bb2bd74dcf2ea71dd5163b87a117cd28809bd05ebc8ad08bfcf4682236fb980a6e5affd0c8737acae1b7c0f14ed01bc734c273660c8b0c7038eb82

  • SSDEEP

    393216:YQtOfDiM8m+J6/lSZRNw2nuNS3NzOZRumEJyb6BF0j6bxPJCX:DO+2/UZRN0QdzOZAmEGGj1PJCX

Malware Config

Signatures

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Slinky\load.exe
    "C:\Users\Admin\AppData\Local\Temp\Slinky\load.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe
      "C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3820
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2760
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4084
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1876
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4388
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:868
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:4760
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3020
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:2268
        • C:\Users\Admin\AppData\Local\Temp\load.exe
          "C:\Users\Admin\AppData\Local\Temp\load.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4396

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        2984662ba3f86d7fcf26758b5b76754d

        SHA1

        bc2a43ffd898222ee84406313f3834f226928379

        SHA256

        f0815f797b0c1829745dd65985f28d459688f91ceb2f3d76fed2d4309589bcde

        SHA512

        a06251a7a14559ebf5627a3c6b03fda9ded1d4ee44991283c824ccf5011cdf67665696d2d9b23507cbb3e3b9943b9e9f79ef28d3657eb61fb99920225417ab11

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        cb3a799921d48256ab45414af88b0aa8

        SHA1

        8888fb5656f5f11576c0fbc3ba45d7df56000d28

        SHA256

        5ad60a0e324106c6b5a8a7c41b4eac83234ed53cf26025dd4d63c0750b265105

        SHA512

        21b53b49d0f95cb600444b15a274c31d9374ae96dc2ab464e6ada96bae11f1000e92f6f51f62e5b91891dbbb30e6ab9c71006a9a166b8d4ae24457dcd7efdf69

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        948B

        MD5

        74a6b79d36b4aae8b027a218bc6e1af7

        SHA1

        0350e46c1df6934903c4820a00b0bc4721779e5f

        SHA256

        60c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04

        SHA512

        60e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        227556da5e65f6819f477756808c17e4

        SHA1

        6ffce766e881ca2a60180bb25f4981b183f78279

        SHA256

        101f5fe8a4192f14e9f0a12c105ca81c9f176860930af44747185dd1bedb59a4

        SHA512

        d46b935809d2c4b7a041ad790f2db11c0a808df022c91ae9152b8769021b884fde49653a7a46557ef9ee65e274fe0b6c8503df9b50e6b3b849fefacf51f8bd6a

      • C:\Users\Admin\AppData\Local\Temp\Slinky Injector.exe

        Filesize

        228KB

        MD5

        22c66a144f89f219d9f7bef81578dd48

        SHA1

        ad7235aadd9583fd423a5f36a5c65a6213d23fff

        SHA256

        9c1f1a7105e258fc4b5df94ba02bd41ddbe55bc82c88cd718fa5b2fac5969f00

        SHA512

        78316d05a92f3c4d9be0f18d1bbc86529961917d83cb00de36a396e96b2357564e354e9cfdc364f08d7e96bdd8602296e6df6eb0d2ea21029c7a45e116edb7a0

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkudnvbn.ix0.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\load.exe

        Filesize

        18.4MB

        MD5

        38019371c7cfc54d0c08629da0384a1f

        SHA1

        87509b8aa5549f22b53362588c624b010cfa5b26

        SHA256

        d4f6bfde46ea2394570619fa89f8cdc8ac00b297179fe8831558530ec48492f1

        SHA512

        75f204fa1be253a68678ec7a6637a8db1b02346fb429365500427e493fd0c2b2d2b24a4ae30de3f777c239af507c141f979b6012c8b394f663d073f2850d682d

      • memory/2760-32-0x000001CED8560000-0x000001CED8582000-memory.dmp

        Filesize

        136KB

      • memory/3980-15-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

        Filesize

        10.8MB

      • memory/3980-16-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

        Filesize

        10.8MB

      • memory/3980-52-0x000001EB68EB0000-0x000001EB68F26000-memory.dmp

        Filesize

        472KB

      • memory/3980-53-0x000001EB68E30000-0x000001EB68E80000-memory.dmp

        Filesize

        320KB

      • memory/3980-54-0x000001EB683C0000-0x000001EB683DE000-memory.dmp

        Filesize

        120KB

      • memory/3980-14-0x000001EB66700000-0x000001EB66740000-memory.dmp

        Filesize

        256KB

      • memory/3980-91-0x000001EB68E80000-0x000001EB68E8A000-memory.dmp

        Filesize

        40KB

      • memory/3980-92-0x000001EB68F30000-0x000001EB68F42000-memory.dmp

        Filesize

        72KB

      • memory/3980-112-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4204-25-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4204-0-0x00007FFE30A13000-0x00007FFE30A15000-memory.dmp

        Filesize

        8KB

      • memory/4204-3-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4204-1-0x0000000000180000-0x000000000131E000-memory.dmp

        Filesize

        17.6MB