Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 02:13
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
232KB
-
MD5
026573734d52b82132fe213163f53273
-
SHA1
6a0651b69e20e3a491c1f98e07710ddbdac85868
-
SHA256
336767cc7d04211aaad18b27760226ade4ce15c5787bc2e71cf66535af2f174e
-
SHA512
0c9c04dc8e6245cf606b0849afb5e486f5cd145a7f0da9371aad29f2022d288c13c52fb63c6e06f3e57ec62db909e8273eb77b372817432a916cb0646261685f
-
SSDEEP
6144:7loZM+rIkd8g+EtXHkv/iD4Hq14QcCFdWfj+ctBI7zb8e1mTi:ZoZtL+EP8Hq14QcCFdWfj+ctBIDR
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2460-0-0x0000000000810000-0x0000000000850000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2460 Umbral.exe Token: SeIncreaseQuotaPrivilege 2888 wmic.exe Token: SeSecurityPrivilege 2888 wmic.exe Token: SeTakeOwnershipPrivilege 2888 wmic.exe Token: SeLoadDriverPrivilege 2888 wmic.exe Token: SeSystemProfilePrivilege 2888 wmic.exe Token: SeSystemtimePrivilege 2888 wmic.exe Token: SeProfSingleProcessPrivilege 2888 wmic.exe Token: SeIncBasePriorityPrivilege 2888 wmic.exe Token: SeCreatePagefilePrivilege 2888 wmic.exe Token: SeBackupPrivilege 2888 wmic.exe Token: SeRestorePrivilege 2888 wmic.exe Token: SeShutdownPrivilege 2888 wmic.exe Token: SeDebugPrivilege 2888 wmic.exe Token: SeSystemEnvironmentPrivilege 2888 wmic.exe Token: SeRemoteShutdownPrivilege 2888 wmic.exe Token: SeUndockPrivilege 2888 wmic.exe Token: SeManageVolumePrivilege 2888 wmic.exe Token: 33 2888 wmic.exe Token: 34 2888 wmic.exe Token: 35 2888 wmic.exe Token: SeIncreaseQuotaPrivilege 2888 wmic.exe Token: SeSecurityPrivilege 2888 wmic.exe Token: SeTakeOwnershipPrivilege 2888 wmic.exe Token: SeLoadDriverPrivilege 2888 wmic.exe Token: SeSystemProfilePrivilege 2888 wmic.exe Token: SeSystemtimePrivilege 2888 wmic.exe Token: SeProfSingleProcessPrivilege 2888 wmic.exe Token: SeIncBasePriorityPrivilege 2888 wmic.exe Token: SeCreatePagefilePrivilege 2888 wmic.exe Token: SeBackupPrivilege 2888 wmic.exe Token: SeRestorePrivilege 2888 wmic.exe Token: SeShutdownPrivilege 2888 wmic.exe Token: SeDebugPrivilege 2888 wmic.exe Token: SeSystemEnvironmentPrivilege 2888 wmic.exe Token: SeRemoteShutdownPrivilege 2888 wmic.exe Token: SeUndockPrivilege 2888 wmic.exe Token: SeManageVolumePrivilege 2888 wmic.exe Token: 33 2888 wmic.exe Token: 34 2888 wmic.exe Token: 35 2888 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2888 2460 Umbral.exe 29 PID 2460 wrote to memory of 2888 2460 Umbral.exe 29 PID 2460 wrote to memory of 2888 2460 Umbral.exe 29