Analysis
-
max time kernel
3s -
max time network
9s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-03-2024 21:18
General
-
Target
Umbral.exe
-
Size
227KB
-
MD5
79dced4f6539dd4227811d59442b199a
-
SHA1
6d343935fbe5a18f2bf5ed5bfde76020976c2a58
-
SHA256
4b1086479acbffef9ad56bb1af174eb2c41ced446aa85e6cc51330d87397bb3c
-
SHA512
1965b33fdfce24dfe54a5b2733d2ec84059860e0b68cca3ea4b1eb4c3f6b74c824ea50f3845244d02918d7185922bebc66a7560a12b5a61ef2651a5793b72049
-
SSDEEP
6144:+loZML9EB1/SqctonEPfCqAjdymlX8k7k+btUgJ0Lh8e1mGmj+:ooZhdSqcwvjdymlX8k7k+btUgJ0Vv1
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4660-0-0x0000012958540000-0x0000012958580000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4660 Umbral.exe Token: SeIncreaseQuotaPrivilege 3036 wmic.exe Token: SeSecurityPrivilege 3036 wmic.exe Token: SeTakeOwnershipPrivilege 3036 wmic.exe Token: SeLoadDriverPrivilege 3036 wmic.exe Token: SeSystemProfilePrivilege 3036 wmic.exe Token: SeSystemtimePrivilege 3036 wmic.exe Token: SeProfSingleProcessPrivilege 3036 wmic.exe Token: SeIncBasePriorityPrivilege 3036 wmic.exe Token: SeCreatePagefilePrivilege 3036 wmic.exe Token: SeBackupPrivilege 3036 wmic.exe Token: SeRestorePrivilege 3036 wmic.exe Token: SeShutdownPrivilege 3036 wmic.exe Token: SeDebugPrivilege 3036 wmic.exe Token: SeSystemEnvironmentPrivilege 3036 wmic.exe Token: SeRemoteShutdownPrivilege 3036 wmic.exe Token: SeUndockPrivilege 3036 wmic.exe Token: SeManageVolumePrivilege 3036 wmic.exe Token: 33 3036 wmic.exe Token: 34 3036 wmic.exe Token: 35 3036 wmic.exe Token: 36 3036 wmic.exe Token: SeIncreaseQuotaPrivilege 3036 wmic.exe Token: SeSecurityPrivilege 3036 wmic.exe Token: SeTakeOwnershipPrivilege 3036 wmic.exe Token: SeLoadDriverPrivilege 3036 wmic.exe Token: SeSystemProfilePrivilege 3036 wmic.exe Token: SeSystemtimePrivilege 3036 wmic.exe Token: SeProfSingleProcessPrivilege 3036 wmic.exe Token: SeIncBasePriorityPrivilege 3036 wmic.exe Token: SeCreatePagefilePrivilege 3036 wmic.exe Token: SeBackupPrivilege 3036 wmic.exe Token: SeRestorePrivilege 3036 wmic.exe Token: SeShutdownPrivilege 3036 wmic.exe Token: SeDebugPrivilege 3036 wmic.exe Token: SeSystemEnvironmentPrivilege 3036 wmic.exe Token: SeRemoteShutdownPrivilege 3036 wmic.exe Token: SeUndockPrivilege 3036 wmic.exe Token: SeManageVolumePrivilege 3036 wmic.exe Token: 33 3036 wmic.exe Token: 34 3036 wmic.exe Token: 35 3036 wmic.exe Token: 36 3036 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4660 wrote to memory of 3036 4660 Umbral.exe 80 PID 4660 wrote to memory of 3036 4660 Umbral.exe 80