Behavioral task
behavioral1
Sample
celex-main.exe
Resource
win7-20230712-en
General
-
Target
celex-main.exe
-
Size
229KB
-
MD5
c876042a9dc5dc33a953a49aa676524f
-
SHA1
359f4ce116552d3118b0d866c974ef127dd3d76f
-
SHA256
d8f6b5f8af4f9741a4f4c8b3b8bb3618120944b660eb6387ca8d3f0bb3d6d8d6
-
SHA512
31f6087e90927c64bef27535321a679f7bd1f00e5c54ae52460b63c56244a8134dd47428627c9f8c99c13478a556fe4506a99f32664d64b6258b73c5c8221aaa
-
SSDEEP
3072:rmpcjvqySgPA9+D9Cocawot18PeXndP5xHki0sMXSl8eN7sbXKcGTSYE:WcWoPAQRrt18ePxHk7y8eNYOpS
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1143539453261000744/aOaDeR72xE-7NCCQoV51Dj-HW0EE6N2H1U3a9GDATYTZYnQHD44szIHHhRvBmmTUv9JU
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource celex-main.exe
Files
-
celex-main.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 212KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ