umbral | ff7706dad388652ba868408d8848872f1a19d0e6f1a730c31c88572af5faa8bf | Triage

Analysis

max time kernel
262s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 09:46

Sharing

Report Analysis Logs

General

Target

Umbral.exe
Size

214KB
MD5

3c8afbf0e5a3922c5947ad31114d684c
SHA1

ad321d5e7a381b74f92b8417249b80edebd2830d
SHA256

ab0377fa096635ef253a94df3982ce2d361413428cba8fe59b4ba3f10101f44a
SHA512

76a47a3113a69f8b09b6d4dae649e2025a9b3cb58c5803630d85123ccf97d2c30cd5a9160df2d77e0ec5e6fac81c2ab06eb0c259033c98b53f1bf1b3aa3509ae
SSDEEP

3072:iXoAc90eBB8Dp4Dbd95jaP6g81D2LpMYXol9rFl88e9Jls5T33OG3z:QclK25lgH78e9JSp3OG

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral6/memory/4840-133-0x000001E2560F0000-0x000001E25612C000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{16868CFD-1975-4FD8-8A71-D2AFAA0EE817}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2D1D5261-BE1A-4C73-88E2-56F47187BFB4}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{40AF180D-BE4D-4581-B33D-59386A10423F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{34EAC60E-095A-41AE-AD52-0909061A2D14}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{301D2D37-77D6-4F30-BDDF-80D1BB3F438A}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{566CE4FC-FAED-4329-B51F-6C3B40D97188}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B1E60958-9250-4A63-9A0E-4337C35CE905}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{053CEDA3-210F-4791-A2C6-FEB550184968}.catalogItem	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	4840	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
1⤵
PID:4840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4840 -s 904
  2⤵
  - Program crash
  PID:2324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4840 -ip 4840
1⤵
PID:2560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4840-133-0x000001E2560F0000-0x000001E25612C000-memory.dmp

Filesize
240KB

Download
memory/4840-134-0x000001E256450000-0x000001E256460000-memory.dmp

Filesize
64KB

Download