Behavioral task
behavioral1
Sample
SynapseX.exe
Resource
win7-20231215-en
General
-
Target
SynapseX.exe
-
Size
234KB
-
MD5
03d95fff9c762454b8a8cea89de2d9e3
-
SHA1
5fdc58b29e10fe6f74ab7dc7d5599b136be0394f
-
SHA256
a08c820009542834baeba92e8aa762d6810fd021de67b05c6429063af206e629
-
SHA512
183d5fae435f0ebcf562258feaed1ea782de2ab67e18a348a469129374d3ac3c73a9b8426e0f34bd4bdaf4f3fae48159c29dbdbbaf03c4a0c4ca693a4eda01d9
-
SSDEEP
6144:nloZM+rIkd8g+EtXHkv/iD4Lu1gBPUonLWvRsY9gfevD8e1m/Ti:loZtL+EP8Lu1gBPUonLWvRsY9DK+
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1176914278230532200/x5Vtyq_bnlvpvUXDc7KQyu_yvTtRqxkcacUU83xicRdezXDNQibPAt-rL13q4AyhmqHf
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SynapseX.exe
Files
-
SynapseX.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ