umbral | 2b02dfe30d1bdad38df832a7164e71c8a0f28a5b780bc0b3a2eba7fbc7def0cb

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21-07-2023 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PI NO HK06162023.exe
Size

326KB
MD5

8049da05dd14298aba0faa157c721664
SHA1

89e0d5226dfac3813466e8d9e4095d1648c19452
SHA256

2b02dfe30d1bdad38df832a7164e71c8a0f28a5b780bc0b3a2eba7fbc7def0cb
SHA512

4ec770d14e652cd102502544dd477b568242ecb69e288d38364a4e6bbbdf48a21934bfd6c1d76f3517c4279c2c6c62ce60dda3b6665140326c40a2f0630989ac
SSDEEP

6144:nYa6xd9Zv5tVDRXf/C7g6ZhfTtITkv9FwgLm+8dNlbSEh0q:nYzdHZDRXnYLHfTt9FwgL81bd/

Score

10^/10

umbral persistence stealer

Malware Config

Extracted

Family

umbral

https://discordapp.com/api/webhooks/1131836991311462550/-mkgzQhSrd73j6lwkfw8nMu_8fZA6dqs-ZNgHOUf_Y8udc7p78mFVaWigCq6Z5erPTXV

Signatures

Detect Umbral payload 4 IoCs

resource	yara_rule
behavioral1/memory/1056-64-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral
behavioral1/memory/1056-66-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral
behavioral1/memory/1056-67-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral
behavioral1/memory/1056-68-0x0000000001EF0000-0x0000000001F30000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Loads dropped DLL 1 IoCs

pid	Process
2616	PI NO HK06162023.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\xhdmvrkgpluajs = "C:\\Users\\Admin\\AppData\\Roaming\\qvfbkoxtdmi\\rnwclqvfokt.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PI NO HK06162023.exe\""	PI NO HK06162023.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 1056	2616	PI NO HK06162023.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2616	PI NO HK06162023.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	PI NO HK06162023.exe
Token: SeIncreaseQuotaPrivilege	2808	wmic.exe
Token: SeSecurityPrivilege	2808	wmic.exe
Token: SeTakeOwnershipPrivilege	2808	wmic.exe
Token: SeLoadDriverPrivilege	2808	wmic.exe
Token: SeSystemProfilePrivilege	2808	wmic.exe
Token: SeSystemtimePrivilege	2808	wmic.exe
Token: SeProfSingleProcessPrivilege	2808	wmic.exe
Token: SeIncBasePriorityPrivilege	2808	wmic.exe
Token: SeCreatePagefilePrivilege	2808	wmic.exe
Token: SeBackupPrivilege	2808	wmic.exe
Token: SeRestorePrivilege	2808	wmic.exe
Token: SeShutdownPrivilege	2808	wmic.exe
Token: SeDebugPrivilege	2808	wmic.exe
Token: SeSystemEnvironmentPrivilege	2808	wmic.exe
Token: SeRemoteShutdownPrivilege	2808	wmic.exe
Token: SeUndockPrivilege	2808	wmic.exe
Token: SeManageVolumePrivilege	2808	wmic.exe
Token: 33	2808	wmic.exe
Token: 34	2808	wmic.exe
Token: 35	2808	wmic.exe
Token: SeIncreaseQuotaPrivilege	2808	wmic.exe
Token: SeSecurityPrivilege	2808	wmic.exe
Token: SeTakeOwnershipPrivilege	2808	wmic.exe
Token: SeLoadDriverPrivilege	2808	wmic.exe
Token: SeSystemProfilePrivilege	2808	wmic.exe
Token: SeSystemtimePrivilege	2808	wmic.exe
Token: SeProfSingleProcessPrivilege	2808	wmic.exe
Token: SeIncBasePriorityPrivilege	2808	wmic.exe
Token: SeCreatePagefilePrivilege	2808	wmic.exe
Token: SeBackupPrivilege	2808	wmic.exe
Token: SeRestorePrivilege	2808	wmic.exe
Token: SeShutdownPrivilege	2808	wmic.exe
Token: SeDebugPrivilege	2808	wmic.exe
Token: SeSystemEnvironmentPrivilege	2808	wmic.exe
Token: SeRemoteShutdownPrivilege	2808	wmic.exe
Token: SeUndockPrivilege	2808	wmic.exe
Token: SeManageVolumePrivilege	2808	wmic.exe
Token: 33	2808	wmic.exe
Token: 34	2808	wmic.exe
Token: 35	2808	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1056	2616	PI NO HK06162023.exe	28
PID 2616 wrote to memory of 1056	2616	PI NO HK06162023.exe	28
PID 2616 wrote to memory of 1056	2616	PI NO HK06162023.exe	28
PID 2616 wrote to memory of 1056	2616	PI NO HK06162023.exe	28
PID 2616 wrote to memory of 1056	2616	PI NO HK06162023.exe	28
PID 1056 wrote to memory of 2808	1056	PI NO HK06162023.exe	29
PID 1056 wrote to memory of 2808	1056	PI NO HK06162023.exe	29
PID 1056 wrote to memory of 2808	1056	PI NO HK06162023.exe	29
PID 1056 wrote to memory of 2808	1056	PI NO HK06162023.exe	29

C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe
"C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe
  "C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy90DC.tmp\vuycy.dll

Filesize
60KB

MD5
336258575918116ff276068258763126

SHA1
acb48872b260631e0664963ca4e62fb2a003ef2f

SHA256
e6b3f5af596ba506f1c0a67146b901483b4d823866bb051d710ad8375e25351f

SHA512
b738fceab64dc49bfc74538fbda81c3293ad0bea8a586b75fb63aa9593cbd8864dc7e5603a5dd73a9162c5f47966f6c4dc7b18fcfd45ad36be43a4292bf6a734

Download Submit
\Users\Admin\AppData\Local\Temp\nsy90DC.tmp\vuycy.dll

Filesize
60KB

MD5
336258575918116ff276068258763126

SHA1
acb48872b260631e0664963ca4e62fb2a003ef2f

SHA256
e6b3f5af596ba506f1c0a67146b901483b4d823866bb051d710ad8375e25351f

SHA512
b738fceab64dc49bfc74538fbda81c3293ad0bea8a586b75fb63aa9593cbd8864dc7e5603a5dd73a9162c5f47966f6c4dc7b18fcfd45ad36be43a4292bf6a734

Download Submit
memory/1056-64-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1056-66-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1056-67-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1056-68-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/1056-69-0x0000000073660000-0x0000000073D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1056-70-0x0000000004600000-0x0000000004640000-memory.dmp

Filesize
256KB

Download
memory/1056-71-0x0000000004600000-0x0000000004640000-memory.dmp

Filesize
256KB

Download
memory/1056-74-0x0000000073660000-0x0000000073D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-62-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads