Overview

overview

10

Static

static

7

ConsoleApp...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ConsoleApplication1_protected.exe
  • Size 24.9MB
  • Sample231105-dsgnvscb79
  • SHA256 35e27fd1445c11bcceede5059823629f428058d70d182dffc4d02ce0a5a5ae41
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
umbralevasionstealerthemidatrojan

Malware Config

Extracted

Family

  • umbral

C2

  • https://discord.com/api/webhooks/1170536634891128902/hdNxkvpSxRXfW2ouud2imDE8eFbcAfoi3fBBxpcoRyxI8E-rxHT7NHLuI-Q-ThYq7M3H

Targets

    • Target
      ConsoleApplication1_protected.exe
    • Size 24.9MB
    • SHA256 35e27fd1445c11bcceede5059823629f428058d70d182dffc4d02ce0a5a5ae41
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    umbralevasionstealerthemidatrojan

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks