Analysis
-
max time kernel
94s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 18:42
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
300 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
5a16bf141dbcf75260bad1c54966e13c
-
SHA1
634be534e99829d3eadf84ca3012e2f1258d89a5
-
SHA256
edd1e3ff0f0c032599ce66382d4f4487660fd283ba5d3013fa3374c4604449b4
-
SHA512
847ac52edf8e62dd3aca4b98c671133e579cd2a1b4f8d69a4066fff08d0ed658848bda4613f42c74e70814ddb00580e06114503d312fcf4df81162d8b85b1725
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4C9MsyVtGtTOMdRYW4l+VF8e1mWj44Di:joZtL+EP8C9MsyVtGtTOMdRYvl6y4O
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral3/memory/1660-0-0x00000260D4190000-0x00000260D41D0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1660 Umbral.exe Token: SeIncreaseQuotaPrivilege 668 wmic.exe Token: SeSecurityPrivilege 668 wmic.exe Token: SeTakeOwnershipPrivilege 668 wmic.exe Token: SeLoadDriverPrivilege 668 wmic.exe Token: SeSystemProfilePrivilege 668 wmic.exe Token: SeSystemtimePrivilege 668 wmic.exe Token: SeProfSingleProcessPrivilege 668 wmic.exe Token: SeIncBasePriorityPrivilege 668 wmic.exe Token: SeCreatePagefilePrivilege 668 wmic.exe Token: SeBackupPrivilege 668 wmic.exe Token: SeRestorePrivilege 668 wmic.exe Token: SeShutdownPrivilege 668 wmic.exe Token: SeDebugPrivilege 668 wmic.exe Token: SeSystemEnvironmentPrivilege 668 wmic.exe Token: SeRemoteShutdownPrivilege 668 wmic.exe Token: SeUndockPrivilege 668 wmic.exe Token: SeManageVolumePrivilege 668 wmic.exe Token: 33 668 wmic.exe Token: 34 668 wmic.exe Token: 35 668 wmic.exe Token: 36 668 wmic.exe Token: SeIncreaseQuotaPrivilege 668 wmic.exe Token: SeSecurityPrivilege 668 wmic.exe Token: SeTakeOwnershipPrivilege 668 wmic.exe Token: SeLoadDriverPrivilege 668 wmic.exe Token: SeSystemProfilePrivilege 668 wmic.exe Token: SeSystemtimePrivilege 668 wmic.exe Token: SeProfSingleProcessPrivilege 668 wmic.exe Token: SeIncBasePriorityPrivilege 668 wmic.exe Token: SeCreatePagefilePrivilege 668 wmic.exe Token: SeBackupPrivilege 668 wmic.exe Token: SeRestorePrivilege 668 wmic.exe Token: SeShutdownPrivilege 668 wmic.exe Token: SeDebugPrivilege 668 wmic.exe Token: SeSystemEnvironmentPrivilege 668 wmic.exe Token: SeRemoteShutdownPrivilege 668 wmic.exe Token: SeUndockPrivilege 668 wmic.exe Token: SeManageVolumePrivilege 668 wmic.exe Token: 33 668 wmic.exe Token: 34 668 wmic.exe Token: 35 668 wmic.exe Token: 36 668 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1660 wrote to memory of 668 1660 Umbral.exe 85 PID 1660 wrote to memory of 668 1660 Umbral.exe 85