Analysis

  • max time kernel
    62s
  • max time network
    68s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2023 05:55

General

  • Target

    Umbral stealer/Umbral.exe

  • Size

    214KB

  • MD5

    1affa0a88288206933690e598fa3d0e7

  • SHA1

    0c843c02bd32efb80a4b38c1a9bbe245524e768d

  • SHA256

    7e326dace3dbc954c2aef9395293ffb90f41ced37c1bb5bb456cab59fcd762c9

  • SHA512

    5486c4e46d7f134cf4ce671cd758d2f21bf92ade6fe0f1cfe17dbd9823cc979b3bbf788ecb4075e6f86a66046ca43d1e64282abbe32ae2d1490d60a047cb27f1

  • SSDEEP

    3072:u3QWTYoU70RiusQXlk+ThpaBtvpe3ZsGYOk6/l88e9JlbdTJG1oAjE:STgAgusLfp6ZsGdju8e9JlzG1Z

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Umbral stealer\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral stealer\Umbral.exe"
    1⤵
      PID:2576

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2576-0-0x0000027F061E0000-0x0000027F0621C000-memory.dmp

      Filesize

      240KB

    • memory/2576-1-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

      Filesize

      10.8MB

    • memory/2576-2-0x0000027F065B0000-0x0000027F065C0000-memory.dmp

      Filesize

      64KB

    • memory/2576-3-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

      Filesize

      10.8MB