Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2025 15:26
Static task
static1
1 signatures
General
-
Target
svchost.exe
-
Size
603KB
-
MD5
cbde7887e32b1c0837b4f5feaccfd19a
-
SHA1
979443ec0ee69c4aa59ba87b7fe631f733f39a68
-
SHA256
20367536f2263f53c3a52f574cbe883e539c7b2fb6cf344c8e1c9f6ed69c8c6c
-
SHA512
a8dbf07713cb6773df248f13b387f9edca8083a4f838b82fbfb571a107cd28125138174192f1dd5fa3dce3ed64cfcbb1ae5be1d96a55261b8621005012f050f8
-
SSDEEP
12288:5LQcwNyJ6oF2FqYTchKt8RjIxEWhD8Tr+38DijMCsiHzBQ:5LGNumChKt8RjOEE8Tr+32yFQ
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/files/0x001200000001ed5e-6.dat family_umbral behavioral1/memory/3124-21-0x00000179A83E0000-0x00000179A8420000-memory.dmp family_umbral -
Umbral family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 3124 Payload.exe 3376 XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5656 3376 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XClient.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1800 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 3124 Payload.exe Token: SeDebugPrivilege 3376 XClient.exe Token: SeIncreaseQuotaPrivilege 1164 wmic.exe Token: SeSecurityPrivilege 1164 wmic.exe Token: SeTakeOwnershipPrivilege 1164 wmic.exe Token: SeLoadDriverPrivilege 1164 wmic.exe Token: SeSystemProfilePrivilege 1164 wmic.exe Token: SeSystemtimePrivilege 1164 wmic.exe Token: SeProfSingleProcessPrivilege 1164 wmic.exe Token: SeIncBasePriorityPrivilege 1164 wmic.exe Token: SeCreatePagefilePrivilege 1164 wmic.exe Token: SeBackupPrivilege 1164 wmic.exe Token: SeRestorePrivilege 1164 wmic.exe Token: SeShutdownPrivilege 1164 wmic.exe Token: SeDebugPrivilege 1164 wmic.exe Token: SeSystemEnvironmentPrivilege 1164 wmic.exe Token: SeRemoteShutdownPrivilege 1164 wmic.exe Token: SeUndockPrivilege 1164 wmic.exe Token: SeManageVolumePrivilege 1164 wmic.exe Token: 33 1164 wmic.exe Token: 34 1164 wmic.exe Token: 35 1164 wmic.exe Token: 36 1164 wmic.exe Token: SeIncreaseQuotaPrivilege 1164 wmic.exe Token: SeSecurityPrivilege 1164 wmic.exe Token: SeTakeOwnershipPrivilege 1164 wmic.exe Token: SeLoadDriverPrivilege 1164 wmic.exe Token: SeSystemProfilePrivilege 1164 wmic.exe Token: SeSystemtimePrivilege 1164 wmic.exe Token: SeProfSingleProcessPrivilege 1164 wmic.exe Token: SeIncBasePriorityPrivilege 1164 wmic.exe Token: SeCreatePagefilePrivilege 1164 wmic.exe Token: SeBackupPrivilege 1164 wmic.exe Token: SeRestorePrivilege 1164 wmic.exe Token: SeShutdownPrivilege 1164 wmic.exe Token: SeDebugPrivilege 1164 wmic.exe Token: SeSystemEnvironmentPrivilege 1164 wmic.exe Token: SeRemoteShutdownPrivilege 1164 wmic.exe Token: SeUndockPrivilege 1164 wmic.exe Token: SeManageVolumePrivilege 1164 wmic.exe Token: 33 1164 wmic.exe Token: 34 1164 wmic.exe Token: 35 1164 wmic.exe Token: 36 1164 wmic.exe Token: SeDebugPrivilege 1800 taskmgr.exe Token: SeSystemProfilePrivilege 1800 taskmgr.exe Token: SeCreateGlobalPrivilege 1800 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3832 wrote to memory of 3124 3832 svchost.exe 83 PID 3832 wrote to memory of 3124 3832 svchost.exe 83 PID 3832 wrote to memory of 3376 3832 svchost.exe 84 PID 3832 wrote to memory of 3376 3832 svchost.exe 84 PID 3832 wrote to memory of 3376 3832 svchost.exe 84 PID 3124 wrote to memory of 1164 3124 Payload.exe 89 PID 3124 wrote to memory of 1164 3124 Payload.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Roaming\Payload.exe"C:\Users\Admin\AppData\Roaming\Payload.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 17523⤵
- Program crash
PID:5656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3376 -ip 33761⤵PID:5616
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD59d5f474cc6fd587802b7b140290be91f
SHA19d409c3cab7eb5c4d2c8f757cb000e9a33ea4d4f
SHA2566a8322ca1b56240e886c733f0092f962a059c0729f8069632701a4dad8eb9aa5
SHA512d702a4e564de4b6ad918a5d1e9a4dce28028bf1d583196b67377a67a576a612f86a0d0a1812233b8853faf6dfb162f58d628f13d12c044cf877aeec5ce42e0d5
-
Filesize
364KB
MD51f6e76213763de98666126aa0bc6b7a0
SHA1d38866afdc9485c053bb63b17348dc003b661ed9
SHA25605ac44c4fe768827e012d4ed73ce74180be394709dadec31144eb2a6f7ca576b
SHA5129f6fbabbeb52e4008783d3fea5b9e5883fbd2bb44042da722208b885a8118aa3604a2a47bfef0914690c05517de125f4e9e67028b1c1f1b685d1b2d9da9633e0