Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-02-2024 22:47
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
ba04373492e8c5f6d1f99b6ec7740f26
-
SHA1
3439a5130e17f4ce9262fdab17c4f6756bf660af
-
SHA256
477d5477a087cd32a0fab03952ffcfbcfb3b179f91bb1378858b355731365933
-
SHA512
38decc359b6b03373b0cc227d5a29bbcffa0ce1df5608be378f443223ce0e5bce5efea247ae30c9652a4fd374c47ea79b423024a5f7fcac56a83599c4bab8336
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4XCleywvrYDhkijD6WFFi4a8e1kAi:noZtL+EP8XCleywvrYDhkijD6aF2U
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2776-0-0x0000000000190000-0x00000000001D0000-memory.dmp family_umbral behavioral1/memory/2776-2-0x000000001B050000-0x000000001B0D0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2776 Umbral.exe Token: SeIncreaseQuotaPrivilege 2632 wmic.exe Token: SeSecurityPrivilege 2632 wmic.exe Token: SeTakeOwnershipPrivilege 2632 wmic.exe Token: SeLoadDriverPrivilege 2632 wmic.exe Token: SeSystemProfilePrivilege 2632 wmic.exe Token: SeSystemtimePrivilege 2632 wmic.exe Token: SeProfSingleProcessPrivilege 2632 wmic.exe Token: SeIncBasePriorityPrivilege 2632 wmic.exe Token: SeCreatePagefilePrivilege 2632 wmic.exe Token: SeBackupPrivilege 2632 wmic.exe Token: SeRestorePrivilege 2632 wmic.exe Token: SeShutdownPrivilege 2632 wmic.exe Token: SeDebugPrivilege 2632 wmic.exe Token: SeSystemEnvironmentPrivilege 2632 wmic.exe Token: SeRemoteShutdownPrivilege 2632 wmic.exe Token: SeUndockPrivilege 2632 wmic.exe Token: SeManageVolumePrivilege 2632 wmic.exe Token: 33 2632 wmic.exe Token: 34 2632 wmic.exe Token: 35 2632 wmic.exe Token: SeIncreaseQuotaPrivilege 2632 wmic.exe Token: SeSecurityPrivilege 2632 wmic.exe Token: SeTakeOwnershipPrivilege 2632 wmic.exe Token: SeLoadDriverPrivilege 2632 wmic.exe Token: SeSystemProfilePrivilege 2632 wmic.exe Token: SeSystemtimePrivilege 2632 wmic.exe Token: SeProfSingleProcessPrivilege 2632 wmic.exe Token: SeIncBasePriorityPrivilege 2632 wmic.exe Token: SeCreatePagefilePrivilege 2632 wmic.exe Token: SeBackupPrivilege 2632 wmic.exe Token: SeRestorePrivilege 2632 wmic.exe Token: SeShutdownPrivilege 2632 wmic.exe Token: SeDebugPrivilege 2632 wmic.exe Token: SeSystemEnvironmentPrivilege 2632 wmic.exe Token: SeRemoteShutdownPrivilege 2632 wmic.exe Token: SeUndockPrivilege 2632 wmic.exe Token: SeManageVolumePrivilege 2632 wmic.exe Token: 33 2632 wmic.exe Token: 34 2632 wmic.exe Token: 35 2632 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2632 2776 Umbral.exe 28 PID 2776 wrote to memory of 2632 2776 Umbral.exe 28 PID 2776 wrote to memory of 2632 2776 Umbral.exe 28