Analysis

  • max time kernel
    14s
  • max time network
    3s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-02-2025 06:13

General

  • Target

    XenoFixer#V2.exe

  • Size

    229KB

  • MD5

    9c90d0907aeacf4cd01f17181174c00a

  • SHA1

    1a6b0899f7b045de415e171c01ee4f4a4d2ca0d6

  • SHA256

    37a693ea922c569717f22f475238acb47b1d519b46644e0ed68a449bccc65e1a

  • SHA512

    88553e52a8d0e4aad59e7996a90ec18d82e127926c296c0200569c1f0c96ae2a144438dd30d7b375abb1bb353c50956301953f81bdbd7330dd1150bd522425c0

  • SSDEEP

    6144:tloZM+rIkd8g+EtXHkv/iD43kz6w2xpaJPyAxVkawb8e1mFi:voZtL+EP83kz6w2xpaJPyAxVkzv

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XenoFixer#V2.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoFixer#V2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5612
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5612-0-0x00007FFC06853000-0x00007FFC06855000-memory.dmp

    Filesize

    8KB

  • memory/5612-1-0x000001FFEF8D0000-0x000001FFEF910000-memory.dmp

    Filesize

    256KB

  • memory/5612-2-0x00007FFC06850000-0x00007FFC07312000-memory.dmp

    Filesize

    10.8MB

  • memory/5612-4-0x00007FFC06850000-0x00007FFC07312000-memory.dmp

    Filesize

    10.8MB