umbral | 419f948e7da8922465cefdda7d2a6b86adf6a6165c8bcf79963e5b2fd8a8f7d5

General

Target

2222.exe
Size

227KB
MD5

2d609a4bb5b23b1811bf7f18c8d86504
SHA1

b3c21506848edd61dcc21e71ecbba740a9929f5b
SHA256

419f948e7da8922465cefdda7d2a6b86adf6a6165c8bcf79963e5b2fd8a8f7d5
SHA512

a73c96bba173c30e64a6d49a9da26b49fca44828f7d3aaa14d4070d1b55b0d0a891e3ba42565c6e94d4ebf085cbb6742b7f5c6956d1019d8fd4cdf07d13953e0
SSDEEP

6144:+loZMorIkd8g+EtXHkv/iD44Z44KInDAvZMK7bCpHb8e1mp8i:ooZHL+EP84Z44KInDAvZMK7bC9qV

Score

10^/10

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/312-0-0x00000215953E0000-0x0000021595420000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
6	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4176	wmic.exe

C:\Users\Admin\AppData\Local\Temp\2222.exe
"C:\Users\Admin\AppData\Local\Temp\2222.exe"
1⤵
PID:312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2222.exe'
  2⤵
  PID:1564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:1760
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:924
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:1732
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  PID:4132
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
2c1f0f61a64b35e072b91dd7cfede8f8

SHA1
9f470400dca0ec854d4b9306dc896f57375b951e

SHA256
2f522b728fb9ab43fe20b27647b3e197862d1ba1eefb6c50f0c7142c1930200c

SHA512
e3bfb901b7ebbf48b706b464a5f29eb1a56c9ebbfd20eeed4027ec6dd47962aa8c059d948501dcf5ebc963b530d011cfe81b0188782d9ddf3e781f9be725f28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
608a33172b8ef5ee6482a31f23a36920

SHA1
afb60bba87ffeb0c42ed2c026bdcfd9d18a07eaf

SHA256
c72811eb1c7e85f961bbc7da186b92de288b34850233d18314037eb621ef9bed

SHA512
2409ccc23054c177b7ecdbda29d652d677067cf7e460501ae06aea58a3a40d7a780e06297aefbd68de9cf8c28e0910bf85e7c7babc2822cffb81c2a74ba6f7f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
360fdb9703f526a4ccea5d26649bdf9b

SHA1
42da277e654927d288df6358ae83f26f31685b6f

SHA256
9398883440fd3111529002e797673c3521cb35ea13a03c1905210184558a497e

SHA512
7099c2832a80dbb00d00d5db5014a9a3f8764cc40a9636b609d5dbf2cfddccb3ad3b74e954d42d13bc8150938dc633e0feea1b3c4eb6ddbf49d96fcebe67eab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9feac2f877dedae7dd5b3d352ee5ff7f

SHA1
1fc885c78262e5a9202b8a43c53c8d77a4899476

SHA256
02c3dbf6595ce79d27fc7ad724214b164184d3fcd5eefc54ea5fb9aaba0b6533

SHA512
c8575f8e054eae9123e8b40fdaf373fa3ec21b7b9375369bae373f94c15464e483d677459e6ac92614ad517eaf971d432eee47ad501c4f9277d8c204fa6834af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfqas2qt.4gi.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/312-179-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/312-169-0x00000215AF960000-0x00000215AF96A000-memory.dmp

Filesize
40KB

Download
memory/312-170-0x00000215AFBA0000-0x00000215AFBB2000-memory.dmp

Filesize
72KB

Download
memory/312-126-0x00000215AF970000-0x00000215AF980000-memory.dmp

Filesize
64KB

Download
memory/312-2-0x00000215AF970000-0x00000215AF980000-memory.dmp

Filesize
64KB

Download
memory/312-0-0x00000215953E0000-0x0000021595420000-memory.dmp

Filesize
256KB

Download
memory/312-97-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/312-1-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/312-91-0x00000215AF940000-0x00000215AF95E000-memory.dmp

Filesize
120KB

Download
memory/312-90-0x00000215AFA80000-0x00000215AFAD0000-memory.dmp

Filesize
320KB

Download
memory/1564-49-0x000001A094B70000-0x000001A094B80000-memory.dmp

Filesize
64KB

Download
memory/1564-26-0x000001A094B70000-0x000001A094B80000-memory.dmp

Filesize
64KB

Download
memory/1564-8-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/1564-7-0x000001A0AD2B0000-0x000001A0AD2D2000-memory.dmp

Filesize
136KB

Download
memory/1564-11-0x000001A094B70000-0x000001A094B80000-memory.dmp

Filesize
64KB

Download
memory/1564-13-0x000001A0AD460000-0x000001A0AD4D6000-memory.dmp

Filesize
472KB

Download
memory/1564-9-0x000001A094B70000-0x000001A094B80000-memory.dmp

Filesize
64KB

Download
memory/1564-53-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/1760-163-0x0000022E6E110000-0x0000022E6E120000-memory.dmp

Filesize
64KB

Download
memory/1760-136-0x0000022E6E110000-0x0000022E6E120000-memory.dmp

Filesize
64KB

Download
memory/1760-135-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/1760-137-0x0000022E6E110000-0x0000022E6E120000-memory.dmp

Filesize
64KB

Download
memory/1760-164-0x0000022E6E110000-0x0000022E6E120000-memory.dmp

Filesize
64KB

Download
memory/1760-167-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/4308-98-0x00000161F26D0000-0x00000161F26E0000-memory.dmp

Filesize
64KB

Download
memory/4308-130-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/4308-128-0x00000161F26D0000-0x00000161F26E0000-memory.dmp

Filesize
64KB

Download
memory/4308-125-0x00000161F26D0000-0x00000161F26E0000-memory.dmp

Filesize
64KB

Download
memory/4308-99-0x00000161F26D0000-0x00000161F26E0000-memory.dmp

Filesize
64KB

Download
memory/4308-93-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/5072-60-0x0000029D1D260000-0x0000029D1D270000-memory.dmp

Filesize
64KB

Download
memory/5072-58-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/5072-61-0x0000029D1D260000-0x0000029D1D270000-memory.dmp

Filesize
64KB

Download
memory/5072-88-0x00007FF9E2530000-0x00007FF9E2F1C000-memory.dmp

Filesize
9.9MB

Download
memory/5072-85-0x0000029D1D260000-0x0000029D1D270000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing