Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 02:09
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
a270d4041c245aec5deeed971fba0e6e
-
SHA1
b9cacd5e11108f37def65b4f17281fa658dde5ef
-
SHA256
34ab1f6b7597b68d9799a803d61a8b07ab4221a887cc038c7dff132d857c26f1
-
SHA512
8c6361c0aca08058bbc3862801247c4516f99bb0935e05ad314e4ee0f9d5eefb41017ba28e5743188b9c68c6495f6a7e3142152aa40737d6955f80b81f626453
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4CiRrQBPUon9WvRsY9jfy8e1mFmi:joZtL+EP8DRrQBPUon9WvRsY9MeL
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/3048-0-0x0000000000F90000-0x0000000000FD0000-memory.dmp family_umbral behavioral1/memory/3048-2-0x000000001B1C0000-0x000000001B240000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3048 Umbral.exe Token: SeIncreaseQuotaPrivilege 2668 wmic.exe Token: SeSecurityPrivilege 2668 wmic.exe Token: SeTakeOwnershipPrivilege 2668 wmic.exe Token: SeLoadDriverPrivilege 2668 wmic.exe Token: SeSystemProfilePrivilege 2668 wmic.exe Token: SeSystemtimePrivilege 2668 wmic.exe Token: SeProfSingleProcessPrivilege 2668 wmic.exe Token: SeIncBasePriorityPrivilege 2668 wmic.exe Token: SeCreatePagefilePrivilege 2668 wmic.exe Token: SeBackupPrivilege 2668 wmic.exe Token: SeRestorePrivilege 2668 wmic.exe Token: SeShutdownPrivilege 2668 wmic.exe Token: SeDebugPrivilege 2668 wmic.exe Token: SeSystemEnvironmentPrivilege 2668 wmic.exe Token: SeRemoteShutdownPrivilege 2668 wmic.exe Token: SeUndockPrivilege 2668 wmic.exe Token: SeManageVolumePrivilege 2668 wmic.exe Token: 33 2668 wmic.exe Token: 34 2668 wmic.exe Token: 35 2668 wmic.exe Token: SeIncreaseQuotaPrivilege 2668 wmic.exe Token: SeSecurityPrivilege 2668 wmic.exe Token: SeTakeOwnershipPrivilege 2668 wmic.exe Token: SeLoadDriverPrivilege 2668 wmic.exe Token: SeSystemProfilePrivilege 2668 wmic.exe Token: SeSystemtimePrivilege 2668 wmic.exe Token: SeProfSingleProcessPrivilege 2668 wmic.exe Token: SeIncBasePriorityPrivilege 2668 wmic.exe Token: SeCreatePagefilePrivilege 2668 wmic.exe Token: SeBackupPrivilege 2668 wmic.exe Token: SeRestorePrivilege 2668 wmic.exe Token: SeShutdownPrivilege 2668 wmic.exe Token: SeDebugPrivilege 2668 wmic.exe Token: SeSystemEnvironmentPrivilege 2668 wmic.exe Token: SeRemoteShutdownPrivilege 2668 wmic.exe Token: SeUndockPrivilege 2668 wmic.exe Token: SeManageVolumePrivilege 2668 wmic.exe Token: 33 2668 wmic.exe Token: 34 2668 wmic.exe Token: 35 2668 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2668 3048 Umbral.exe 28 PID 3048 wrote to memory of 2668 3048 Umbral.exe 28 PID 3048 wrote to memory of 2668 3048 Umbral.exe 28