Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 13:00
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
910a5896b1488769e91e985b0dbba73f
-
SHA1
2416ce9e4e5b8843520acc93b4ac4a157a29b261
-
SHA256
60edfe75e435ed4ce8c42bad52ba9986c1d5bb3359fad93da6987e2131124888
-
SHA512
bcc0fc3c9b6fd8eacfa62b83053e2637a8ec61520ce72795317f2719136f1883ad4b5cbd386a7c71064ae55958cadc7b03055dfefe2511b2b78843c32d18ee83
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4uzBdCg/7IiR0STTKBoXb8e1mJi:joZtL+EP8uzBdCg/7IiR0STTKgf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3052-0-0x0000000001250000-0x0000000001290000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3052 Umbral.exe Token: SeIncreaseQuotaPrivilege 2772 wmic.exe Token: SeSecurityPrivilege 2772 wmic.exe Token: SeTakeOwnershipPrivilege 2772 wmic.exe Token: SeLoadDriverPrivilege 2772 wmic.exe Token: SeSystemProfilePrivilege 2772 wmic.exe Token: SeSystemtimePrivilege 2772 wmic.exe Token: SeProfSingleProcessPrivilege 2772 wmic.exe Token: SeIncBasePriorityPrivilege 2772 wmic.exe Token: SeCreatePagefilePrivilege 2772 wmic.exe Token: SeBackupPrivilege 2772 wmic.exe Token: SeRestorePrivilege 2772 wmic.exe Token: SeShutdownPrivilege 2772 wmic.exe Token: SeDebugPrivilege 2772 wmic.exe Token: SeSystemEnvironmentPrivilege 2772 wmic.exe Token: SeRemoteShutdownPrivilege 2772 wmic.exe Token: SeUndockPrivilege 2772 wmic.exe Token: SeManageVolumePrivilege 2772 wmic.exe Token: 33 2772 wmic.exe Token: 34 2772 wmic.exe Token: 35 2772 wmic.exe Token: SeIncreaseQuotaPrivilege 2772 wmic.exe Token: SeSecurityPrivilege 2772 wmic.exe Token: SeTakeOwnershipPrivilege 2772 wmic.exe Token: SeLoadDriverPrivilege 2772 wmic.exe Token: SeSystemProfilePrivilege 2772 wmic.exe Token: SeSystemtimePrivilege 2772 wmic.exe Token: SeProfSingleProcessPrivilege 2772 wmic.exe Token: SeIncBasePriorityPrivilege 2772 wmic.exe Token: SeCreatePagefilePrivilege 2772 wmic.exe Token: SeBackupPrivilege 2772 wmic.exe Token: SeRestorePrivilege 2772 wmic.exe Token: SeShutdownPrivilege 2772 wmic.exe Token: SeDebugPrivilege 2772 wmic.exe Token: SeSystemEnvironmentPrivilege 2772 wmic.exe Token: SeRemoteShutdownPrivilege 2772 wmic.exe Token: SeUndockPrivilege 2772 wmic.exe Token: SeManageVolumePrivilege 2772 wmic.exe Token: 33 2772 wmic.exe Token: 34 2772 wmic.exe Token: 35 2772 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2772 3052 Umbral.exe 28 PID 3052 wrote to memory of 2772 3052 Umbral.exe 28 PID 3052 wrote to memory of 2772 3052 Umbral.exe 28