umbral | 5e9142e06299d70195c1d5876ee384995822943ea8747fc725830a7c7cac85d7 | Triage

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 16:16

Sharing

Report Analysis Logs

General

Target

Fpsunlockerexe.exe
Size

231KB
MD5

8e0d0543f4eb1e8e5d14a0ee3a7ac228
SHA1

adfede75871a2196e79856335aca757ccaa3c1f0
SHA256

5e9142e06299d70195c1d5876ee384995822943ea8747fc725830a7c7cac85d7
SHA512

150aa1b2d7807e5b8283fa726015036862ee84ddcdc3b870a18da9d3f94ea7356ef2f62c0c21c1c6137a33ffa55ca52713558f08bcaeb4dca1dd63e6c8163d02
SSDEEP

6144:xloZM+rIkd8g+EtXHkv/iD41Irt4+ZRS93q459cL8b8e1mVzi:DoZtL+EP81Irt4+ZRS93q459cIge

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/memory/2040-54-0x0000000000210000-0x0000000000250000-memory.dmp	family_umbral
behavioral1/memory/2040-55-0x000000001AE10000-0x000000001AE90000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	Fpsunlockerexe.exe

C:\Users\Admin\AppData\Local\Temp\Fpsunlockerexe.exe
"C:\Users\Admin\AppData\Local\Temp\Fpsunlockerexe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000210000-0x0000000000250000-memory.dmp

Filesize
256KB

Download
memory/2040-55-0x000000001AE10000-0x000000001AE90000-memory.dmp

Filesize
512KB

Download
memory/2040-56-0x000000001AE10000-0x000000001AE90000-memory.dmp

Filesize
512KB

Download