umbral | 81046d6d4e474115dd898d8e4718bc2ba144928461baa26e23f26d73d8e3f2f7

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 17:07

Target

RbxCheats.exe
Size

217KB
MD5

84fe5aaf9d71e59205c851af53d6a1c7
SHA1

1b93e136c567dce28cccd900a02b694d9f488d86
SHA256

81046d6d4e474115dd898d8e4718bc2ba144928461baa26e23f26d73d8e3f2f7
SHA512

db3bfcbccd1b6e22754fd40841f2b2f0d229852879ab1c10e214d8185e5c29f8a8d3e318182c80a2887cf77f7e59aa3e95088b2901eb96720afd9e4f7d775a2d
SSDEEP

3072:WlP/chtWkOIGSAvD6vdnsUSaNZZDOAuIXk0IIIIIIEIIIIIIIIIIIlTIIIIIIIII:OcyHIGadsUSsZDO7+8eNHpDS

Score

10^/10

umbral stealer

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/1716-54-0x0000000000B00000-0x0000000000B3C000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	RbxCheats.exe
Token: 33	1528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1528	AUDIODG.EXE
Token: 33	1528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1528	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\RbxCheats.exe
"C:\Users\Admin\AppData\Local\Temp\RbxCheats.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528

memory/1716-54-0x0000000000B00000-0x0000000000B3C000-memory.dmp

Filesize
240KB

Download
memory/1716-55-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download
memory/1716-56-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download