umbral | 0ee57e25d9dccaa575f6bcd6aa484819da305bb44fe42b88a051061f11713274

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2023 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order-Ref UT15312 07.2023.exe
Size

648KB
MD5

ef453336c093eeabb30bb54c788d640e
SHA1

808fd09c9121898ae8af98852a981b51a8e362e8
SHA256

e673799c649ad85cfac2fdca9ca5924ba17e7d7f10220ea183f81a9f25d3418e
SHA512

2df3cf544fbc9764ae3fae28e73f9e90bbec5e5c7ba5ae1390dbf7968b9ac2da96b569e4343ff74b4b7ef299b5dc05cb2b1fb2c9498f2e61d7e6bf10f6ccd40d
SSDEEP

12288:8f2iN2GULjRpIRbUatfj3VMFJdWe4bwdD2QROHp/ZxBvH9ZycelO2m:8f1xULjRpIuOjSpV48dD+fBvnelO2m

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral4/memory/3960-142-0x0000000000400000-0x0000000000440000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 3960	1552	Order-Ref UT15312 07.2023.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	Order-Ref UT15312 07.2023.exe
1552	Order-Ref UT15312 07.2023.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	Order-Ref UT15312 07.2023.exe
Token: SeDebugPrivilege	3960	Order-Ref UT15312 07.2023.exe
Token: SeIncreaseQuotaPrivilege	4328	wmic.exe
Token: SeSecurityPrivilege	4328	wmic.exe
Token: SeTakeOwnershipPrivilege	4328	wmic.exe
Token: SeLoadDriverPrivilege	4328	wmic.exe
Token: SeSystemProfilePrivilege	4328	wmic.exe
Token: SeSystemtimePrivilege	4328	wmic.exe
Token: SeProfSingleProcessPrivilege	4328	wmic.exe
Token: SeIncBasePriorityPrivilege	4328	wmic.exe
Token: SeCreatePagefilePrivilege	4328	wmic.exe
Token: SeBackupPrivilege	4328	wmic.exe
Token: SeRestorePrivilege	4328	wmic.exe
Token: SeShutdownPrivilege	4328	wmic.exe
Token: SeDebugPrivilege	4328	wmic.exe
Token: SeSystemEnvironmentPrivilege	4328	wmic.exe
Token: SeRemoteShutdownPrivilege	4328	wmic.exe
Token: SeUndockPrivilege	4328	wmic.exe
Token: SeManageVolumePrivilege	4328	wmic.exe
Token: 33	4328	wmic.exe
Token: 34	4328	wmic.exe
Token: 35	4328	wmic.exe
Token: 36	4328	wmic.exe
Token: SeIncreaseQuotaPrivilege	4328	wmic.exe
Token: SeSecurityPrivilege	4328	wmic.exe
Token: SeTakeOwnershipPrivilege	4328	wmic.exe
Token: SeLoadDriverPrivilege	4328	wmic.exe
Token: SeSystemProfilePrivilege	4328	wmic.exe
Token: SeSystemtimePrivilege	4328	wmic.exe
Token: SeProfSingleProcessPrivilege	4328	wmic.exe
Token: SeIncBasePriorityPrivilege	4328	wmic.exe
Token: SeCreatePagefilePrivilege	4328	wmic.exe
Token: SeBackupPrivilege	4328	wmic.exe
Token: SeRestorePrivilege	4328	wmic.exe
Token: SeShutdownPrivilege	4328	wmic.exe
Token: SeDebugPrivilege	4328	wmic.exe
Token: SeSystemEnvironmentPrivilege	4328	wmic.exe
Token: SeRemoteShutdownPrivilege	4328	wmic.exe
Token: SeUndockPrivilege	4328	wmic.exe
Token: SeManageVolumePrivilege	4328	wmic.exe
Token: 33	4328	wmic.exe
Token: 34	4328	wmic.exe
Token: 35	4328	wmic.exe
Token: 36	4328	wmic.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2680	1552	Order-Ref UT15312 07.2023.exe	95
PID 1552 wrote to memory of 2680	1552	Order-Ref UT15312 07.2023.exe	95
PID 1552 wrote to memory of 2680	1552	Order-Ref UT15312 07.2023.exe	95
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 1552 wrote to memory of 3960	1552	Order-Ref UT15312 07.2023.exe	96
PID 3960 wrote to memory of 4328	3960	Order-Ref UT15312 07.2023.exe	97
PID 3960 wrote to memory of 4328	3960	Order-Ref UT15312 07.2023.exe	97
PID 3960 wrote to memory of 4328	3960	Order-Ref UT15312 07.2023.exe	97

C:\Users\Admin\AppData\Local\Temp\Order-Ref UT15312 07.2023.exe
"C:\Users\Admin\AppData\Local\Temp\Order-Ref UT15312 07.2023.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\Order-Ref UT15312 07.2023.exe
  "C:\Users\Admin\AppData\Local\Temp\Order-Ref UT15312 07.2023.exe"
  2⤵
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\Order-Ref UT15312 07.2023.exe
  "C:\Users\Admin\AppData\Local\Temp\Order-Ref UT15312 07.2023.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order-Ref UT15312 07.2023.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1552-139-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/1552-141-0x0000000009AE0000-0x0000000009B7C000-memory.dmp

Filesize
624KB

Download
memory/1552-136-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/1552-137-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/1552-138-0x0000000005890000-0x000000000589A000-memory.dmp

Filesize
40KB

Download
memory/1552-133-0x0000000000D50000-0x0000000000DF8000-memory.dmp

Filesize
672KB

Download
memory/1552-140-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/1552-135-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/1552-146-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/1552-134-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/3960-145-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/3960-142-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3960-147-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/3960-148-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download