umbral | 0082170e2185d53ec008632a7e8d10b6ff831c063dd2fbf23b6a888f21e6da29 | Triage

Analysis

max time kernel
139s
max time network
141s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07-07-2023 00:02

Sharing

Report Analysis Logs

General

Target

Imperial.Stealer.exe
Size

287KB
MD5

f0a434e6a2826a3bb563c59dfe720a94
SHA1

46899f6dda27a9ddc7f0849f999a7d7851f6960c
SHA256

0082170e2185d53ec008632a7e8d10b6ff831c063dd2fbf23b6a888f21e6da29
SHA512

14fd13968cbc005764e43bfc62056c953a3c61c94f90888b9a3c26d3c0b1b8645335e7c950ad05787bd75423c5a2d310baf08dc41ed6aef99f773cab76f694e4
SSDEEP

6144:+loZM+rIkd8g+EtXHkv/iD4U8OK/w2xpaqPyAxVk1Eb8e1mwi:ooZtL+EP8U8OK/w2xpaqPyAxVkOG

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/memory/2412-54-0x00000000001F0000-0x000000000023E000-memory.dmp	family_umbral
behavioral1/memory/2412-55-0x000000001A6F0000-0x000000001A770000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	Imperial.Stealer.exe

C:\Users\Admin\AppData\Local\Temp\Imperial.Stealer.exe
"C:\Users\Admin\AppData\Local\Temp\Imperial.Stealer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-54-0x00000000001F0000-0x000000000023E000-memory.dmp

Filesize
312KB

Download
memory/2412-55-0x000000001A6F0000-0x000000001A770000-memory.dmp

Filesize
512KB

Download
memory/2412-56-0x000000001A6F0000-0x000000001A770000-memory.dmp

Filesize
512KB

Download