Extracted

Extracted

• • Target
    processhacker-2.39-setup.exe
  • Size 2.7MB
  • SHA256 87c3b9b12d6b65dac71853210bf5ab1ca4595a6ca23c09f0f74c498f16484e56
  • MD5 e4c1ca690b73c05c97a5db0a7feaa0b5
  • SHA1 3a9348841ab65bc81ef7b00594c41b736e5611e6
  • SHA512 6e9a5bae11ec99aca91eab1a8bdefc4385e3f910b4ea9b1ef1732dadbd2aa05ee0f1e614ce4cc5127b32f549cbfec6bcbf8b8fa939c3b0fae139e1c198df5a5d
  • SSDEEP 49152:3TSddtii2csLZh4dI2wJfBE16L9iJV/nWrbUg+OOC03fr/419XK9XmEwEwfDprI:3TSddT2zZ+gBEmoX/nWrogWC03T/EaQ1
  • TLSH
    T1E5D51271C71D8A63C87407F0A2A9D77060BF6C5829F8C5A9BD85B499C2BBDC4EE1C760
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasiondiscoveryexecutionumbralxwormpackerpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1