umbral | cfa411af1d47bc7a40db5d2e085c8a8612c4d0eafb6bd3e2b03ec9ee93231b7d

General

Target

Umbral.exe
Size

229KB
MD5

5ec6cda5b85ebfb0f92c52746a8dd01f
SHA1

0653b964a484e3c73877440f7366c0b477f4dbc0
SHA256

cfa411af1d47bc7a40db5d2e085c8a8612c4d0eafb6bd3e2b03ec9ee93231b7d
SHA512

0d357a50125de49172d0e672450e915c4e5ec121fbc22ab36146d23bfa23037549e31df9afcadfa0bbea6431eeb68ce02a40cf450c864808191018c94ddda73d
SSDEEP

6144:lloZMUrIkd8g+EtXHkv/iD4amR+0ad1+H7mEl5QnIb8e1mBi:noZrL+EP8amR+0ad1+H7mEl5Qwb

Score

10^/10

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/936-0-0x0000023AF55B0000-0x0000023AF55F0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3900	wmic.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
1⤵
PID:936
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Views/modifies file attributes
  PID:4760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
  2⤵
  PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:1760
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:1272
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2132
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  PID:648
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
567d7fef99fd45b4def9fa7b093384e2

SHA1
e6a0a4657276cca5142193ad980e34d1ed382f41

SHA256
7ec7b5f3f860f6b4a326dcc883a2bd3f57bac0a5774418b48e3ef54c2cd2893c

SHA512
f45b7876ae0e3eac9dee187f2b901da361caf20e2aebc545408a95f6926a2b3a13233392d085487a76e6972784877637576bf8f9b644c0d59cea02f9177aa711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
c65738617888921a153bd9b1ef516ee7

SHA1
5245e71ea3c181d76320c857b639272ac9e079b1

SHA256
4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26

SHA512
2e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3xjgm5za.lb1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/648-101-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/648-106-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/648-102-0x00000231AFAF0000-0x00000231AFB00000-memory.dmp

Filesize
64KB

Download
memory/648-103-0x00000231AFAF0000-0x00000231AFB00000-memory.dmp

Filesize
64KB

Download
memory/648-104-0x00000231AFAF0000-0x00000231AFB00000-memory.dmp

Filesize
64KB

Download
memory/936-40-0x0000023AF7CF0000-0x0000023AF7D66000-memory.dmp

Filesize
472KB

Download
memory/936-70-0x0000023AF5A20000-0x0000023AF5A30000-memory.dmp

Filesize
64KB

Download
memory/936-2-0x0000023AF5A20000-0x0000023AF5A30000-memory.dmp

Filesize
64KB

Download
memory/936-1-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/936-88-0x0000023AF7CB0000-0x0000023AF7CC2000-memory.dmp

Filesize
72KB

Download
memory/936-87-0x0000023AF7C80000-0x0000023AF7C8A000-memory.dmp

Filesize
40KB

Download
memory/936-37-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/936-42-0x0000023AF7DE0000-0x0000023AF7DFE000-memory.dmp

Filesize
120KB

Download
memory/936-41-0x0000023AF7D70000-0x0000023AF7DC0000-memory.dmp

Filesize
320KB

Download
memory/936-0-0x0000023AF55B0000-0x0000023AF55F0000-memory.dmp

Filesize
256KB

Download
memory/1248-15-0x00000245F9E20000-0x00000245F9E30000-memory.dmp

Filesize
64KB

Download
memory/1248-17-0x00000245F9E20000-0x00000245F9E30000-memory.dmp

Filesize
64KB

Download
memory/1248-16-0x00000245F9E20000-0x00000245F9E30000-memory.dmp

Filesize
64KB

Download
memory/1248-3-0x00000245F9FF0000-0x00000245FA012000-memory.dmp

Filesize
136KB

Download
memory/1248-20-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/1248-4-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/1248-10-0x00000245F9E20000-0x00000245F9E30000-memory.dmp

Filesize
64KB

Download
memory/1512-35-0x00000159B90E0000-0x00000159B90F0000-memory.dmp

Filesize
64KB

Download
memory/1512-34-0x00000159B90E0000-0x00000159B90F0000-memory.dmp

Filesize
64KB

Download
memory/1512-38-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-32-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-33-0x00000159B90E0000-0x00000159B90F0000-memory.dmp

Filesize
64KB

Download
memory/1760-81-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/1760-85-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/1760-83-0x000002A18C030000-0x000002A18C040000-memory.dmp

Filesize
64KB

Download
memory/1760-82-0x000002A18C030000-0x000002A18C040000-memory.dmp

Filesize
64KB

Download
memory/4016-69-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/4016-45-0x000001C41E1A0000-0x000001C41E1B0000-memory.dmp

Filesize
64KB

Download
memory/4016-43-0x00007FF987D20000-0x00007FF9887E1000-memory.dmp

Filesize
10.8MB

Download
memory/4016-44-0x000001C41E1A0000-0x000001C41E1B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing