Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 14:06
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
23f649b9914154a95545d1d882006fd9
-
SHA1
50ef26e9ab8be10d8972fc36aaee1bad0766c8db
-
SHA256
422b393c43488dfeb747caea3c825e7ee6a8c38197029804b28f8f3ea2cd9e86
-
SHA512
4416da36dc6259b97f3fed52247a7d9468d1b51e4c2d9a556f0b8c78f74da070e6b533ba7eca0a93480e1323b22700ca897db3077ba4755a9374ee942c73f4e9
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4r6rzKInDAHZMK7bCC6cEIet8e1mVi:voZtL+EP8erzKInDAHZMK7bCJIgX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2540-0-0x0000021736590000-0x00000217365D0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2540 Umbral.exe Token: SeIncreaseQuotaPrivilege 1740 wmic.exe Token: SeSecurityPrivilege 1740 wmic.exe Token: SeTakeOwnershipPrivilege 1740 wmic.exe Token: SeLoadDriverPrivilege 1740 wmic.exe Token: SeSystemProfilePrivilege 1740 wmic.exe Token: SeSystemtimePrivilege 1740 wmic.exe Token: SeProfSingleProcessPrivilege 1740 wmic.exe Token: SeIncBasePriorityPrivilege 1740 wmic.exe Token: SeCreatePagefilePrivilege 1740 wmic.exe Token: SeBackupPrivilege 1740 wmic.exe Token: SeRestorePrivilege 1740 wmic.exe Token: SeShutdownPrivilege 1740 wmic.exe Token: SeDebugPrivilege 1740 wmic.exe Token: SeSystemEnvironmentPrivilege 1740 wmic.exe Token: SeRemoteShutdownPrivilege 1740 wmic.exe Token: SeUndockPrivilege 1740 wmic.exe Token: SeManageVolumePrivilege 1740 wmic.exe Token: 33 1740 wmic.exe Token: 34 1740 wmic.exe Token: 35 1740 wmic.exe Token: 36 1740 wmic.exe Token: SeIncreaseQuotaPrivilege 1740 wmic.exe Token: SeSecurityPrivilege 1740 wmic.exe Token: SeTakeOwnershipPrivilege 1740 wmic.exe Token: SeLoadDriverPrivilege 1740 wmic.exe Token: SeSystemProfilePrivilege 1740 wmic.exe Token: SeSystemtimePrivilege 1740 wmic.exe Token: SeProfSingleProcessPrivilege 1740 wmic.exe Token: SeIncBasePriorityPrivilege 1740 wmic.exe Token: SeCreatePagefilePrivilege 1740 wmic.exe Token: SeBackupPrivilege 1740 wmic.exe Token: SeRestorePrivilege 1740 wmic.exe Token: SeShutdownPrivilege 1740 wmic.exe Token: SeDebugPrivilege 1740 wmic.exe Token: SeSystemEnvironmentPrivilege 1740 wmic.exe Token: SeRemoteShutdownPrivilege 1740 wmic.exe Token: SeUndockPrivilege 1740 wmic.exe Token: SeManageVolumePrivilege 1740 wmic.exe Token: 33 1740 wmic.exe Token: 34 1740 wmic.exe Token: 35 1740 wmic.exe Token: 36 1740 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1740 2540 Umbral.exe 97 PID 2540 wrote to memory of 1740 2540 Umbral.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:3312