Analysis
-
max time kernel
316s -
max time network
320s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
21-02-2024 18:42
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
300 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
5a16bf141dbcf75260bad1c54966e13c
-
SHA1
634be534e99829d3eadf84ca3012e2f1258d89a5
-
SHA256
edd1e3ff0f0c032599ce66382d4f4487660fd283ba5d3013fa3374c4604449b4
-
SHA512
847ac52edf8e62dd3aca4b98c671133e579cd2a1b4f8d69a4066fff08d0ed658848bda4613f42c74e70814ddb00580e06114503d312fcf4df81162d8b85b1725
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4C9MsyVtGtTOMdRYW4l+VF8e1mWj44Di:joZtL+EP8C9MsyVtGtTOMdRYvl6y4O
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4628-0-0x0000021C510E0000-0x0000021C51120000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4628 Umbral.exe Token: SeIncreaseQuotaPrivilege 4868 wmic.exe Token: SeSecurityPrivilege 4868 wmic.exe Token: SeTakeOwnershipPrivilege 4868 wmic.exe Token: SeLoadDriverPrivilege 4868 wmic.exe Token: SeSystemProfilePrivilege 4868 wmic.exe Token: SeSystemtimePrivilege 4868 wmic.exe Token: SeProfSingleProcessPrivilege 4868 wmic.exe Token: SeIncBasePriorityPrivilege 4868 wmic.exe Token: SeCreatePagefilePrivilege 4868 wmic.exe Token: SeBackupPrivilege 4868 wmic.exe Token: SeRestorePrivilege 4868 wmic.exe Token: SeShutdownPrivilege 4868 wmic.exe Token: SeDebugPrivilege 4868 wmic.exe Token: SeSystemEnvironmentPrivilege 4868 wmic.exe Token: SeRemoteShutdownPrivilege 4868 wmic.exe Token: SeUndockPrivilege 4868 wmic.exe Token: SeManageVolumePrivilege 4868 wmic.exe Token: 33 4868 wmic.exe Token: 34 4868 wmic.exe Token: 35 4868 wmic.exe Token: 36 4868 wmic.exe Token: SeIncreaseQuotaPrivilege 4868 wmic.exe Token: SeSecurityPrivilege 4868 wmic.exe Token: SeTakeOwnershipPrivilege 4868 wmic.exe Token: SeLoadDriverPrivilege 4868 wmic.exe Token: SeSystemProfilePrivilege 4868 wmic.exe Token: SeSystemtimePrivilege 4868 wmic.exe Token: SeProfSingleProcessPrivilege 4868 wmic.exe Token: SeIncBasePriorityPrivilege 4868 wmic.exe Token: SeCreatePagefilePrivilege 4868 wmic.exe Token: SeBackupPrivilege 4868 wmic.exe Token: SeRestorePrivilege 4868 wmic.exe Token: SeShutdownPrivilege 4868 wmic.exe Token: SeDebugPrivilege 4868 wmic.exe Token: SeSystemEnvironmentPrivilege 4868 wmic.exe Token: SeRemoteShutdownPrivilege 4868 wmic.exe Token: SeUndockPrivilege 4868 wmic.exe Token: SeManageVolumePrivilege 4868 wmic.exe Token: 33 4868 wmic.exe Token: 34 4868 wmic.exe Token: 35 4868 wmic.exe Token: 36 4868 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4868 4628 Umbral.exe 73 PID 4628 wrote to memory of 4868 4628 Umbral.exe 73