Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-02-2024 18:42
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
300 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
5a16bf141dbcf75260bad1c54966e13c
-
SHA1
634be534e99829d3eadf84ca3012e2f1258d89a5
-
SHA256
edd1e3ff0f0c032599ce66382d4f4487660fd283ba5d3013fa3374c4604449b4
-
SHA512
847ac52edf8e62dd3aca4b98c671133e579cd2a1b4f8d69a4066fff08d0ed658848bda4613f42c74e70814ddb00580e06114503d312fcf4df81162d8b85b1725
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4C9MsyVtGtTOMdRYW4l+VF8e1mWj44Di:joZtL+EP8C9MsyVtGtTOMdRYvl6y4O
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1908-0-0x0000000000210000-0x0000000000250000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1908 Umbral.exe Token: SeIncreaseQuotaPrivilege 3068 wmic.exe Token: SeSecurityPrivilege 3068 wmic.exe Token: SeTakeOwnershipPrivilege 3068 wmic.exe Token: SeLoadDriverPrivilege 3068 wmic.exe Token: SeSystemProfilePrivilege 3068 wmic.exe Token: SeSystemtimePrivilege 3068 wmic.exe Token: SeProfSingleProcessPrivilege 3068 wmic.exe Token: SeIncBasePriorityPrivilege 3068 wmic.exe Token: SeCreatePagefilePrivilege 3068 wmic.exe Token: SeBackupPrivilege 3068 wmic.exe Token: SeRestorePrivilege 3068 wmic.exe Token: SeShutdownPrivilege 3068 wmic.exe Token: SeDebugPrivilege 3068 wmic.exe Token: SeSystemEnvironmentPrivilege 3068 wmic.exe Token: SeRemoteShutdownPrivilege 3068 wmic.exe Token: SeUndockPrivilege 3068 wmic.exe Token: SeManageVolumePrivilege 3068 wmic.exe Token: 33 3068 wmic.exe Token: 34 3068 wmic.exe Token: 35 3068 wmic.exe Token: SeIncreaseQuotaPrivilege 3068 wmic.exe Token: SeSecurityPrivilege 3068 wmic.exe Token: SeTakeOwnershipPrivilege 3068 wmic.exe Token: SeLoadDriverPrivilege 3068 wmic.exe Token: SeSystemProfilePrivilege 3068 wmic.exe Token: SeSystemtimePrivilege 3068 wmic.exe Token: SeProfSingleProcessPrivilege 3068 wmic.exe Token: SeIncBasePriorityPrivilege 3068 wmic.exe Token: SeCreatePagefilePrivilege 3068 wmic.exe Token: SeBackupPrivilege 3068 wmic.exe Token: SeRestorePrivilege 3068 wmic.exe Token: SeShutdownPrivilege 3068 wmic.exe Token: SeDebugPrivilege 3068 wmic.exe Token: SeSystemEnvironmentPrivilege 3068 wmic.exe Token: SeRemoteShutdownPrivilege 3068 wmic.exe Token: SeUndockPrivilege 3068 wmic.exe Token: SeManageVolumePrivilege 3068 wmic.exe Token: 33 3068 wmic.exe Token: 34 3068 wmic.exe Token: 35 3068 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1908 wrote to memory of 3068 1908 Umbral.exe 28 PID 1908 wrote to memory of 3068 1908 Umbral.exe 28 PID 1908 wrote to memory of 3068 1908 Umbral.exe 28