Analysis
- max time kernel
316s - max time network
320s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system - submitted
21/02/2024, 18:42
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
300 seconds
General
- Target Umbral.exe
- Size 231KB
- Sample240221-xcjcasdh76
- SHA256 edd1e3ff0f0c032599ce66382d4f4487660fd283ba5d3013fa3374c4604449b4
- MD5 5a16bf141dbcf75260bad1c54966e13c
- SHA1 634be534e99829d3eadf84ca3012e2f1258d89a5
- SHA512 847ac52edf8e62dd3aca4b98c671133e579cd2a1b4f8d69a4066fff08d0ed658848bda4613f42c74e70814ddb00580e06114503d312fcf4df81162d8b85b1725
- SSDEEP 6144:RloZM+rIkd8g+EtXHkv/iD4C9MsyVtGtTOMdRYW4l+VF8e1mWj44Di:joZtL+EP8C9MsyVtGtTOMdRYvl6y4O
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4628-0-0x0000021C510E0000-0x0000021C51120000-memory.dmp family_umbral - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4628 Umbral.exe Token: SeIncreaseQuotaPrivilege 4868 wmic.exe Token: SeSecurityPrivilege 4868 wmic.exe Token: SeTakeOwnershipPrivilege 4868 wmic.exe Token: SeLoadDriverPrivilege 4868 wmic.exe Token: SeSystemProfilePrivilege 4868 wmic.exe Token: SeSystemtimePrivilege 4868 wmic.exe Token: SeProfSingleProcessPrivilege 4868 wmic.exe Token: SeIncBasePriorityPrivilege 4868 wmic.exe Token: SeCreatePagefilePrivilege 4868 wmic.exe Token: SeBackupPrivilege 4868 wmic.exe Token: SeRestorePrivilege 4868 wmic.exe Token: SeShutdownPrivilege 4868 wmic.exe Token: SeDebugPrivilege 4868 wmic.exe Token: SeSystemEnvironmentPrivilege 4868 wmic.exe Token: SeRemoteShutdownPrivilege 4868 wmic.exe Token: SeUndockPrivilege 4868 wmic.exe Token: SeManageVolumePrivilege 4868 wmic.exe Token: 33 4868 wmic.exe Token: 34 4868 wmic.exe Token: 35 4868 wmic.exe Token: 36 4868 wmic.exe Token: SeIncreaseQuotaPrivilege 4868 wmic.exe Token: SeSecurityPrivilege 4868 wmic.exe Token: SeTakeOwnershipPrivilege 4868 wmic.exe Token: SeLoadDriverPrivilege 4868 wmic.exe Token: SeSystemProfilePrivilege 4868 wmic.exe Token: SeSystemtimePrivilege 4868 wmic.exe Token: SeProfSingleProcessPrivilege 4868 wmic.exe Token: SeIncBasePriorityPrivilege 4868 wmic.exe Token: SeCreatePagefilePrivilege 4868 wmic.exe Token: SeBackupPrivilege 4868 wmic.exe Token: SeRestorePrivilege 4868 wmic.exe Token: SeShutdownPrivilege 4868 wmic.exe Token: SeDebugPrivilege 4868 wmic.exe Token: SeSystemEnvironmentPrivilege 4868 wmic.exe Token: SeRemoteShutdownPrivilege 4868 wmic.exe Token: SeUndockPrivilege 4868 wmic.exe Token: SeManageVolumePrivilege 4868 wmic.exe Token: 33 4868 wmic.exe Token: 34 4868 wmic.exe Token: 35 4868 wmic.exe Token: 36 4868 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4868 4628 Umbral.exe 73 PID 4628 wrote to memory of 4868 4628 Umbral.exe 73