Analysis
-
max time kernel
142s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
10/10/2023, 22:23
General
-
Target
Celestial.exe
-
Size
251KB
-
MD5
bd135af56e98782a34081767be973f13
-
SHA1
8e60cf769dba53a1465e55831062729bedfbb146
-
SHA256
ed702d0b8e9551446f6ffa0363286712615e10bfdfe66d039bfc9db861f6ab19
-
SHA512
2c4611886912e354d823fb740dd0372ac6c2ca80235e5d37b5a37efda75c2deceba8a395e3a402dcc614014bf68518e14683cac57baa8abb330fe71e9e36ea2f
-
SSDEEP
6144:IloZMLrIkd8g+EtXHkv/iD4vxBomkrHMe9YW3X2B+b8e1mhbUiIQFceQx:WoZ0L+EP8vxBomkrHMe9YW3X2gWbd0e+
Score
10/10
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial.exe"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
-
Filesize
280KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB