Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
10-10-2023 22:22
General
-
Target
celestial.exe
-
Size
229KB
-
MD5
d57ec258aaffb601a3594f9ac3a44b6d
-
SHA1
c4b592284058deda8356b1a66e80903ddbd00f1f
-
SHA256
de34cde65aade458fe105a3d66395848e4102a0d179d16e72d1538069faee469
-
SHA512
300cae33a20e9d17c2211ee88867b1395ee094eb34f0e25143914935bb0148a60f9f3f89e7184dd2c83cc5b74871edce617ee51c26320e1b61811c83a0400c2a
-
SSDEEP
6144:tloZMJrIkd8g+EtXHkv/iD4cME/EKtFuKr20VJg8qb8e1mQei:voZKL+EP8cME/EKtFuKr20VJgD3
Score
10/10
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\celestial.exe"C:\Users\Admin\AppData\Local\Temp\celestial.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
256KB
-
Filesize
512KB
-
Filesize
512KB