Analysis
-
max time kernel
120s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 13:01
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
910a5896b1488769e91e985b0dbba73f
-
SHA1
2416ce9e4e5b8843520acc93b4ac4a157a29b261
-
SHA256
60edfe75e435ed4ce8c42bad52ba9986c1d5bb3359fad93da6987e2131124888
-
SHA512
bcc0fc3c9b6fd8eacfa62b83053e2637a8ec61520ce72795317f2719136f1883ad4b5cbd386a7c71064ae55958cadc7b03055dfefe2511b2b78843c32d18ee83
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4uzBdCg/7IiR0STTKBoXb8e1mJi:joZtL+EP8uzBdCg/7IiR0STTKgf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2212-0-0x0000000000E10000-0x0000000000E50000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2212 Umbral.exe Token: SeIncreaseQuotaPrivilege 2756 wmic.exe Token: SeSecurityPrivilege 2756 wmic.exe Token: SeTakeOwnershipPrivilege 2756 wmic.exe Token: SeLoadDriverPrivilege 2756 wmic.exe Token: SeSystemProfilePrivilege 2756 wmic.exe Token: SeSystemtimePrivilege 2756 wmic.exe Token: SeProfSingleProcessPrivilege 2756 wmic.exe Token: SeIncBasePriorityPrivilege 2756 wmic.exe Token: SeCreatePagefilePrivilege 2756 wmic.exe Token: SeBackupPrivilege 2756 wmic.exe Token: SeRestorePrivilege 2756 wmic.exe Token: SeShutdownPrivilege 2756 wmic.exe Token: SeDebugPrivilege 2756 wmic.exe Token: SeSystemEnvironmentPrivilege 2756 wmic.exe Token: SeRemoteShutdownPrivilege 2756 wmic.exe Token: SeUndockPrivilege 2756 wmic.exe Token: SeManageVolumePrivilege 2756 wmic.exe Token: 33 2756 wmic.exe Token: 34 2756 wmic.exe Token: 35 2756 wmic.exe Token: SeIncreaseQuotaPrivilege 2756 wmic.exe Token: SeSecurityPrivilege 2756 wmic.exe Token: SeTakeOwnershipPrivilege 2756 wmic.exe Token: SeLoadDriverPrivilege 2756 wmic.exe Token: SeSystemProfilePrivilege 2756 wmic.exe Token: SeSystemtimePrivilege 2756 wmic.exe Token: SeProfSingleProcessPrivilege 2756 wmic.exe Token: SeIncBasePriorityPrivilege 2756 wmic.exe Token: SeCreatePagefilePrivilege 2756 wmic.exe Token: SeBackupPrivilege 2756 wmic.exe Token: SeRestorePrivilege 2756 wmic.exe Token: SeShutdownPrivilege 2756 wmic.exe Token: SeDebugPrivilege 2756 wmic.exe Token: SeSystemEnvironmentPrivilege 2756 wmic.exe Token: SeRemoteShutdownPrivilege 2756 wmic.exe Token: SeUndockPrivilege 2756 wmic.exe Token: SeManageVolumePrivilege 2756 wmic.exe Token: 33 2756 wmic.exe Token: 34 2756 wmic.exe Token: 35 2756 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2756 2212 Umbral.exe 28 PID 2212 wrote to memory of 2756 2212 Umbral.exe 28 PID 2212 wrote to memory of 2756 2212 Umbral.exe 28