umbral | 2b02dfe30d1bdad38df832a7164e71c8a0f28a5b780bc0b3a2eba7fbc7def0cb

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2023 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PI NO HK06162023.exe
Size

326KB
MD5

8049da05dd14298aba0faa157c721664
SHA1

89e0d5226dfac3813466e8d9e4095d1648c19452
SHA256

2b02dfe30d1bdad38df832a7164e71c8a0f28a5b780bc0b3a2eba7fbc7def0cb
SHA512

4ec770d14e652cd102502544dd477b568242ecb69e288d38364a4e6bbbdf48a21934bfd6c1d76f3517c4279c2c6c62ce60dda3b6665140326c40a2f0630989ac
SSDEEP

6144:nYa6xd9Zv5tVDRXf/C7g6ZhfTtITkv9FwgLm+8dNlbSEh0q:nYzdHZDRXnYLHfTt9FwgL81bd/

Score

10^/10

umbral persistence stealer

Malware Config

Signatures

Detect Umbral payload 4 IoCs

resource	yara_rule
behavioral2/memory/3808-142-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral
behavioral2/memory/3808-143-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral
behavioral2/memory/3808-144-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral
behavioral2/memory/3808-145-0x0000000000400000-0x0000000000451000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Loads dropped DLL 1 IoCs

pid	Process
212	PI NO HK06162023.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xhdmvrkgpluajs = "C:\\Users\\Admin\\AppData\\Roaming\\qvfbkoxtdmi\\rnwclqvfokt.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PI NO HK06162023.exe\""	PI NO HK06162023.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 212 set thread context of 3808	212	PI NO HK06162023.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
212	PI NO HK06162023.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	PI NO HK06162023.exe
Token: SeIncreaseQuotaPrivilege	4780	wmic.exe
Token: SeSecurityPrivilege	4780	wmic.exe
Token: SeTakeOwnershipPrivilege	4780	wmic.exe
Token: SeLoadDriverPrivilege	4780	wmic.exe
Token: SeSystemProfilePrivilege	4780	wmic.exe
Token: SeSystemtimePrivilege	4780	wmic.exe
Token: SeProfSingleProcessPrivilege	4780	wmic.exe
Token: SeIncBasePriorityPrivilege	4780	wmic.exe
Token: SeCreatePagefilePrivilege	4780	wmic.exe
Token: SeBackupPrivilege	4780	wmic.exe
Token: SeRestorePrivilege	4780	wmic.exe
Token: SeShutdownPrivilege	4780	wmic.exe
Token: SeDebugPrivilege	4780	wmic.exe
Token: SeSystemEnvironmentPrivilege	4780	wmic.exe
Token: SeRemoteShutdownPrivilege	4780	wmic.exe
Token: SeUndockPrivilege	4780	wmic.exe
Token: SeManageVolumePrivilege	4780	wmic.exe
Token: 33	4780	wmic.exe
Token: 34	4780	wmic.exe
Token: 35	4780	wmic.exe
Token: 36	4780	wmic.exe
Token: SeIncreaseQuotaPrivilege	4780	wmic.exe
Token: SeSecurityPrivilege	4780	wmic.exe
Token: SeTakeOwnershipPrivilege	4780	wmic.exe
Token: SeLoadDriverPrivilege	4780	wmic.exe
Token: SeSystemProfilePrivilege	4780	wmic.exe
Token: SeSystemtimePrivilege	4780	wmic.exe
Token: SeProfSingleProcessPrivilege	4780	wmic.exe
Token: SeIncBasePriorityPrivilege	4780	wmic.exe
Token: SeCreatePagefilePrivilege	4780	wmic.exe
Token: SeBackupPrivilege	4780	wmic.exe
Token: SeRestorePrivilege	4780	wmic.exe
Token: SeShutdownPrivilege	4780	wmic.exe
Token: SeDebugPrivilege	4780	wmic.exe
Token: SeSystemEnvironmentPrivilege	4780	wmic.exe
Token: SeRemoteShutdownPrivilege	4780	wmic.exe
Token: SeUndockPrivilege	4780	wmic.exe
Token: SeManageVolumePrivilege	4780	wmic.exe
Token: 33	4780	wmic.exe
Token: 34	4780	wmic.exe
Token: 35	4780	wmic.exe
Token: 36	4780	wmic.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3808	212	PI NO HK06162023.exe	84
PID 212 wrote to memory of 3808	212	PI NO HK06162023.exe	84
PID 212 wrote to memory of 3808	212	PI NO HK06162023.exe	84
PID 212 wrote to memory of 3808	212	PI NO HK06162023.exe	84
PID 3808 wrote to memory of 4780	3808	PI NO HK06162023.exe	85
PID 3808 wrote to memory of 4780	3808	PI NO HK06162023.exe	85
PID 3808 wrote to memory of 4780	3808	PI NO HK06162023.exe	85

C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe
"C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe
  "C:\Users\Admin\AppData\Local\Temp\PI NO HK06162023.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu6B20.tmp\vuycy.dll

Filesize
60KB

MD5
336258575918116ff276068258763126

SHA1
acb48872b260631e0664963ca4e62fb2a003ef2f

SHA256
e6b3f5af596ba506f1c0a67146b901483b4d823866bb051d710ad8375e25351f

SHA512
b738fceab64dc49bfc74538fbda81c3293ad0bea8a586b75fb63aa9593cbd8864dc7e5603a5dd73a9162c5f47966f6c4dc7b18fcfd45ad36be43a4292bf6a734

Download Submit
memory/212-140-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/3808-142-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3808-143-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3808-144-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3808-145-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3808-146-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/3808-147-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/3808-148-0x00000000049D0000-0x0000000004A62000-memory.dmp

Filesize
584KB

Download
memory/3808-149-0x0000000004A80000-0x0000000005024000-memory.dmp

Filesize
5.6MB

Download
memory/3808-153-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads