Analysis
-
max time kernel
92s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 22:47
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
ba04373492e8c5f6d1f99b6ec7740f26
-
SHA1
3439a5130e17f4ce9262fdab17c4f6756bf660af
-
SHA256
477d5477a087cd32a0fab03952ffcfbcfb3b179f91bb1378858b355731365933
-
SHA512
38decc359b6b03373b0cc227d5a29bbcffa0ce1df5608be378f443223ce0e5bce5efea247ae30c9652a4fd374c47ea79b423024a5f7fcac56a83599c4bab8336
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4XCleywvrYDhkijD6WFFi4a8e1kAi:noZtL+EP8XCleywvrYDhkijD6aF2U
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/184-0-0x000002EA14320000-0x000002EA14360000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 184 Umbral.exe Token: SeIncreaseQuotaPrivilege 5008 wmic.exe Token: SeSecurityPrivilege 5008 wmic.exe Token: SeTakeOwnershipPrivilege 5008 wmic.exe Token: SeLoadDriverPrivilege 5008 wmic.exe Token: SeSystemProfilePrivilege 5008 wmic.exe Token: SeSystemtimePrivilege 5008 wmic.exe Token: SeProfSingleProcessPrivilege 5008 wmic.exe Token: SeIncBasePriorityPrivilege 5008 wmic.exe Token: SeCreatePagefilePrivilege 5008 wmic.exe Token: SeBackupPrivilege 5008 wmic.exe Token: SeRestorePrivilege 5008 wmic.exe Token: SeShutdownPrivilege 5008 wmic.exe Token: SeDebugPrivilege 5008 wmic.exe Token: SeSystemEnvironmentPrivilege 5008 wmic.exe Token: SeRemoteShutdownPrivilege 5008 wmic.exe Token: SeUndockPrivilege 5008 wmic.exe Token: SeManageVolumePrivilege 5008 wmic.exe Token: 33 5008 wmic.exe Token: 34 5008 wmic.exe Token: 35 5008 wmic.exe Token: 36 5008 wmic.exe Token: SeIncreaseQuotaPrivilege 5008 wmic.exe Token: SeSecurityPrivilege 5008 wmic.exe Token: SeTakeOwnershipPrivilege 5008 wmic.exe Token: SeLoadDriverPrivilege 5008 wmic.exe Token: SeSystemProfilePrivilege 5008 wmic.exe Token: SeSystemtimePrivilege 5008 wmic.exe Token: SeProfSingleProcessPrivilege 5008 wmic.exe Token: SeIncBasePriorityPrivilege 5008 wmic.exe Token: SeCreatePagefilePrivilege 5008 wmic.exe Token: SeBackupPrivilege 5008 wmic.exe Token: SeRestorePrivilege 5008 wmic.exe Token: SeShutdownPrivilege 5008 wmic.exe Token: SeDebugPrivilege 5008 wmic.exe Token: SeSystemEnvironmentPrivilege 5008 wmic.exe Token: SeRemoteShutdownPrivilege 5008 wmic.exe Token: SeUndockPrivilege 5008 wmic.exe Token: SeManageVolumePrivilege 5008 wmic.exe Token: 33 5008 wmic.exe Token: 34 5008 wmic.exe Token: 35 5008 wmic.exe Token: 36 5008 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 184 wrote to memory of 5008 184 Umbral.exe 90 PID 184 wrote to memory of 5008 184 Umbral.exe 90