umbral | 6c727f906a78ce58fd0970cce1216eaafa833f12ee8f6da2d42839d5ef00fb87

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

609KB
MD5

9893f79d958d0fdf80c2f87fa526696c
SHA1

b5349594b66680de00dd1c64e8ad23f5b60bedec
SHA256

6c727f906a78ce58fd0970cce1216eaafa833f12ee8f6da2d42839d5ef00fb87
SHA512

e0eb174f7b0f8e83c9010836bba865cb2320d94c87939f9ec18a1f029bc5eb1baa8691d25c84ed9cf330c4d6f61e627fb2b01393934f38853f44eacea9110e9e
SSDEEP

12288:EoZcL+EP8LhahecjfUn1gevPeVTv6iPVle8w15dQPvY:HI8dahecjfUn1gevPeV7s15uY

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/2516-5-0x0000000000400000-0x00000000004A0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Executes dropped EXE 1 IoCs

pid	Process
2160	Java(TM) Platform SE binary.exe

Loads dropped DLL 1 IoCs

pid	Process
2516	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2160	2516	Loader.exe	28
PID 2516 wrote to memory of 2160	2516	Loader.exe	28
PID 2516 wrote to memory of 2160	2516	Loader.exe	28
PID 2516 wrote to memory of 2160	2516	Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe
  "C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe"
  2⤵
  - Executes dropped EXE
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe

Filesize
370KB

MD5
c25915f16c086d12c8eb256280e54c96

SHA1
3166757e19b289aa60a628bc199c4aedcdbb021e

SHA256
6d73cb7547926091d83c99452681203ed83369d58029d688702e2291065ab067

SHA512
4a066f363410546b1e9934dc74a91f1708c1bcc3121a79b6196ff2c8c43c4a14ba893df8c362dbb3cfc2645dc00059b7c458bf0fe8c8b13792753724cfe2e68b

Download Submit
memory/2160-7-0x00000000001B0000-0x000000000020E000-memory.dmp

Filesize
376KB

Download
memory/2160-8-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-9-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-5-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download