umbral | df837d571a8f552df3a44469366f7d6c37d433da7e6c7ca9becd765fc8ba0d96 | Triage

Resubmissions

26/06/2023, 18:18

230626-wxlsgsbc83 10

26/06/2023, 18:16

230626-wwf6lsbc77 10

Analysis

max time kernel
19s
max time network
10s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
26/06/2023, 18:18

Sharing

Report Analysis Logs

General

Target

ASyncInstaller.exe
Size

237KB
MD5

1f94b0726f9c4ccde5292a244e595c1e
SHA1

ee2db8938d1ac5592c6eacf365b1c120babb1322
SHA256

50a9e0e6b3593f062d99c960114ee9db03359c56f2c515a819a9b2d1f3826d24
SHA512

be5298ccae48eaaca14208d4de64683d50b4c0ce2ad41fff114e090f43e9ce42724fccc64cea09ae55dadf66dad96d367383c0680fabec271fbc409327be5bca
SSDEEP

6144:NloZMLXU9Zx0kt8X0/PSCsMPuzc9rI8jz67NokRShb8e1m+6il:PoZPf0kkP+uzc9rI8jz67NokRev

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/1760-54-0x0000000000B90000-0x0000000000BD0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	ASyncInstaller.exe

C:\Users\Admin\AppData\Local\Temp\ASyncInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ASyncInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-54-0x0000000000B90000-0x0000000000BD0000-memory.dmp

Filesize
256KB

Download
memory/1760-55-0x000000001B310000-0x000000001B390000-memory.dmp

Filesize
512KB

Download