Analysis
- max time kernel
94s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
22/02/2025, 02:34
Behavioral task
behavioral1
Sample
ID TOLL HAKER.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
- Target ID TOLL HAKER.exe
- Size 230KB
- Sample250222-c2wzgawkdt
- SHA256 c59ef7d6d7af7d2196cf240b6a553ffa9754c11b4c17c0e99a6fe2d04ea0bfda
- MD5 1b8e46d407820787a4dccb0d0922788c
- SHA1 de5efbaca828296b631a23a0ae7b3059aa006e95
- SHA512 3ec56097228028455183907f95251a183acdd8ad7f9df872d8e1f4bfaab0f10bbe3304d7fccc5640fc5f1e0a79710290a91af20fffc526afdaaa21e2a8809dac
- SSDEEP 6144:lloZM+rIkd8g+EtXHkv/iD4z2/uAmB5Ky/Cwhl0vRb8e1mii:noZtL+EP8z2/uAmB5Ky/Cwhl0B8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2996-1-0x000001BA2ACF0000-0x000001BA2AD30000-memory.dmp family_umbral - Umbral family
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2996 ID TOLL HAKER.exe Token: SeIncreaseQuotaPrivilege 3544 wmic.exe Token: SeSecurityPrivilege 3544 wmic.exe Token: SeTakeOwnershipPrivilege 3544 wmic.exe Token: SeLoadDriverPrivilege 3544 wmic.exe Token: SeSystemProfilePrivilege 3544 wmic.exe Token: SeSystemtimePrivilege 3544 wmic.exe Token: SeProfSingleProcessPrivilege 3544 wmic.exe Token: SeIncBasePriorityPrivilege 3544 wmic.exe Token: SeCreatePagefilePrivilege 3544 wmic.exe Token: SeBackupPrivilege 3544 wmic.exe Token: SeRestorePrivilege 3544 wmic.exe Token: SeShutdownPrivilege 3544 wmic.exe Token: SeDebugPrivilege 3544 wmic.exe Token: SeSystemEnvironmentPrivilege 3544 wmic.exe Token: SeRemoteShutdownPrivilege 3544 wmic.exe Token: SeUndockPrivilege 3544 wmic.exe Token: SeManageVolumePrivilege 3544 wmic.exe Token: 33 3544 wmic.exe Token: 34 3544 wmic.exe Token: 35 3544 wmic.exe Token: 36 3544 wmic.exe Token: SeIncreaseQuotaPrivilege 3544 wmic.exe Token: SeSecurityPrivilege 3544 wmic.exe Token: SeTakeOwnershipPrivilege 3544 wmic.exe Token: SeLoadDriverPrivilege 3544 wmic.exe Token: SeSystemProfilePrivilege 3544 wmic.exe Token: SeSystemtimePrivilege 3544 wmic.exe Token: SeProfSingleProcessPrivilege 3544 wmic.exe Token: SeIncBasePriorityPrivilege 3544 wmic.exe Token: SeCreatePagefilePrivilege 3544 wmic.exe Token: SeBackupPrivilege 3544 wmic.exe Token: SeRestorePrivilege 3544 wmic.exe Token: SeShutdownPrivilege 3544 wmic.exe Token: SeDebugPrivilege 3544 wmic.exe Token: SeSystemEnvironmentPrivilege 3544 wmic.exe Token: SeRemoteShutdownPrivilege 3544 wmic.exe Token: SeUndockPrivilege 3544 wmic.exe Token: SeManageVolumePrivilege 3544 wmic.exe Token: 33 3544 wmic.exe Token: 34 3544 wmic.exe Token: 35 3544 wmic.exe Token: 36 3544 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2996 wrote to memory of 3544 2996 ID TOLL HAKER.exe 85 PID 2996 wrote to memory of 3544 2996 ID TOLL HAKER.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\ID TOLL HAKER.exe"C:\Users\Admin\AppData\Local\Temp\ID TOLL HAKER.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3544
-