Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 09:08
Behavioral task
behavioral1
Sample
dllmain.exe
Resource
win7-20240221-en
General
-
Target
dllmain.exe
-
Size
229KB
-
MD5
411156b1cc6ca8a2722edb9a9bf15991
-
SHA1
93441490e31783317bb8b3c2e4a9d0916eb4674d
-
SHA256
0697ab58f1b4c94620982f20ffc2e1069974a7f4c38c804e3a15a3d3f54a89d5
-
SHA512
61609bbcf4b09a5feb0ba72b531687f73bb3ee1e12dd7bda6ab2a4b5caf33f39e91df7f200184b63039cd7eee2b6b95575a89f5f03850d4841861ca3f4e377b5
-
SSDEEP
6144:tloZMNrIkd8g+EtXHkv/iD4vW2mmkrHMl9YW3X241b8e1mik4i:voZmL+EP8vW2mmkrHMl9YW3X2MXkB
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2252-1-0x00000000013D0000-0x0000000001410000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2688 powershell.exe 2752 powershell.exe 2476 powershell.exe 1964 powershell.exe 540 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
dllmain.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exewmic.exedescription pid process Token: SeDebugPrivilege 2252 dllmain.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 2476 powershell.exe Token: SeDebugPrivilege 1964 powershell.exe Token: SeIncreaseQuotaPrivilege 1892 wmic.exe Token: SeSecurityPrivilege 1892 wmic.exe Token: SeTakeOwnershipPrivilege 1892 wmic.exe Token: SeLoadDriverPrivilege 1892 wmic.exe Token: SeSystemProfilePrivilege 1892 wmic.exe Token: SeSystemtimePrivilege 1892 wmic.exe Token: SeProfSingleProcessPrivilege 1892 wmic.exe Token: SeIncBasePriorityPrivilege 1892 wmic.exe Token: SeCreatePagefilePrivilege 1892 wmic.exe Token: SeBackupPrivilege 1892 wmic.exe Token: SeRestorePrivilege 1892 wmic.exe Token: SeShutdownPrivilege 1892 wmic.exe Token: SeDebugPrivilege 1892 wmic.exe Token: SeSystemEnvironmentPrivilege 1892 wmic.exe Token: SeRemoteShutdownPrivilege 1892 wmic.exe Token: SeUndockPrivilege 1892 wmic.exe Token: SeManageVolumePrivilege 1892 wmic.exe Token: 33 1892 wmic.exe Token: 34 1892 wmic.exe Token: 35 1892 wmic.exe Token: SeIncreaseQuotaPrivilege 1892 wmic.exe Token: SeSecurityPrivilege 1892 wmic.exe Token: SeTakeOwnershipPrivilege 1892 wmic.exe Token: SeLoadDriverPrivilege 1892 wmic.exe Token: SeSystemProfilePrivilege 1892 wmic.exe Token: SeSystemtimePrivilege 1892 wmic.exe Token: SeProfSingleProcessPrivilege 1892 wmic.exe Token: SeIncBasePriorityPrivilege 1892 wmic.exe Token: SeCreatePagefilePrivilege 1892 wmic.exe Token: SeBackupPrivilege 1892 wmic.exe Token: SeRestorePrivilege 1892 wmic.exe Token: SeShutdownPrivilege 1892 wmic.exe Token: SeDebugPrivilege 1892 wmic.exe Token: SeSystemEnvironmentPrivilege 1892 wmic.exe Token: SeRemoteShutdownPrivilege 1892 wmic.exe Token: SeUndockPrivilege 1892 wmic.exe Token: SeManageVolumePrivilege 1892 wmic.exe Token: 33 1892 wmic.exe Token: 34 1892 wmic.exe Token: 35 1892 wmic.exe Token: SeIncreaseQuotaPrivilege 1744 wmic.exe Token: SeSecurityPrivilege 1744 wmic.exe Token: SeTakeOwnershipPrivilege 1744 wmic.exe Token: SeLoadDriverPrivilege 1744 wmic.exe Token: SeSystemProfilePrivilege 1744 wmic.exe Token: SeSystemtimePrivilege 1744 wmic.exe Token: SeProfSingleProcessPrivilege 1744 wmic.exe Token: SeIncBasePriorityPrivilege 1744 wmic.exe Token: SeCreatePagefilePrivilege 1744 wmic.exe Token: SeBackupPrivilege 1744 wmic.exe Token: SeRestorePrivilege 1744 wmic.exe Token: SeShutdownPrivilege 1744 wmic.exe Token: SeDebugPrivilege 1744 wmic.exe Token: SeSystemEnvironmentPrivilege 1744 wmic.exe Token: SeRemoteShutdownPrivilege 1744 wmic.exe Token: SeUndockPrivilege 1744 wmic.exe Token: SeManageVolumePrivilege 1744 wmic.exe Token: 33 1744 wmic.exe Token: 34 1744 wmic.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
dllmain.exedescription pid process target process PID 2252 wrote to memory of 2688 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2688 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2688 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2752 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2752 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2752 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2476 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2476 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 2476 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 1964 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 1964 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 1964 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 1892 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1892 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1892 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1744 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1744 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1744 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 2292 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 2292 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 2292 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 540 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 540 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 540 2252 dllmain.exe powershell.exe PID 2252 wrote to memory of 1132 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1132 2252 dllmain.exe wmic.exe PID 2252 wrote to memory of 1132 2252 dllmain.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dllmain.exe"C:\Users\Admin\AppData\Local\Temp\dllmain.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dllmain.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD538f8610455057bc8027ef9effa9cc5dd
SHA13f6a7a0936b6b6d62e1a1e94053077bed6562ebd
SHA256eee68bb973a51f51018289537fdd023109a5b25da23a706338424de1c473e5c2
SHA512ad5c96dbb4e97defe51fb2d17d1a6eaef23fe2f8a170615715d60699b8d7f991e95d453aa5dafbdac304df3810d181f2ae059cd5428f2efb92cf32f69fc606f1
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/540-45-0x000000001B590000-0x000000001B872000-memory.dmpFilesize
2.9MB
-
memory/2252-1-0x00000000013D0000-0x0000000001410000-memory.dmpFilesize
256KB
-
memory/2252-2-0x000007FEF5C20000-0x000007FEF660C000-memory.dmpFilesize
9.9MB
-
memory/2252-49-0x000007FEF5C20000-0x000007FEF660C000-memory.dmpFilesize
9.9MB
-
memory/2252-0-0x000007FEF5C23000-0x000007FEF5C24000-memory.dmpFilesize
4KB
-
memory/2688-8-0x000000001B560000-0x000000001B842000-memory.dmpFilesize
2.9MB
-
memory/2688-11-0x000007FEEE760000-0x000007FEEF0FD000-memory.dmpFilesize
9.6MB
-
memory/2688-10-0x000007FEEE760000-0x000007FEEF0FD000-memory.dmpFilesize
9.6MB
-
memory/2688-14-0x000007FEEE760000-0x000007FEEF0FD000-memory.dmpFilesize
9.6MB
-
memory/2688-15-0x000007FEEE760000-0x000007FEEF0FD000-memory.dmpFilesize
9.6MB
-
memory/2688-12-0x000007FEEE760000-0x000007FEEF0FD000-memory.dmpFilesize
9.6MB
-
memory/2688-13-0x000007FEEE760000-0x000007FEEF0FD000-memory.dmpFilesize
9.6MB
-
memory/2688-9-0x0000000001D80000-0x0000000001D88000-memory.dmpFilesize
32KB
-
memory/2688-7-0x000007FEEEA1E000-0x000007FEEEA1F000-memory.dmpFilesize
4KB
-
memory/2752-21-0x000000001B690000-0x000000001B972000-memory.dmpFilesize
2.9MB
-
memory/2752-22-0x0000000002810000-0x0000000002818000-memory.dmpFilesize
32KB