Analysis
-
max time kernel
0s -
max time network
3s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-03-2024 21:25
General
-
Target
Umbral.exe
-
Size
230KB
-
MD5
10a62be7829b09b546511cfe6fabb84a
-
SHA1
fe599f4244ba26aa9329ee996fe3a612e677df31
-
SHA256
9f17ee652fae0bf1a3d12ea84e88526b4aae9fb1e440fdf9669f607f04d84f06
-
SHA512
4fbbcb0624d73a662c4aa4f28ba0cb71577d9cf2cb7fd5436e872d8d0341374751c0320252ff0ee756d82c81c106f8c084160f791824974eccb963e4cadea777
-
SSDEEP
6144:F1se+uecVM7hTSdm6836MZo+I/r8e1LCS:0H8VQv6MZo+u
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1924-0-0x000002A253B90000-0x000002A253BD0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 1924 Umbral.exe Token: SeIncreaseQuotaPrivilege 1868 wmic.exe Token: SeSecurityPrivilege 1868 wmic.exe Token: SeTakeOwnershipPrivilege 1868 wmic.exe Token: SeLoadDriverPrivilege 1868 wmic.exe Token: SeSystemProfilePrivilege 1868 wmic.exe Token: SeSystemtimePrivilege 1868 wmic.exe Token: SeProfSingleProcessPrivilege 1868 wmic.exe Token: SeIncBasePriorityPrivilege 1868 wmic.exe Token: SeCreatePagefilePrivilege 1868 wmic.exe Token: SeBackupPrivilege 1868 wmic.exe Token: SeRestorePrivilege 1868 wmic.exe Token: SeShutdownPrivilege 1868 wmic.exe Token: SeDebugPrivilege 1868 wmic.exe Token: SeSystemEnvironmentPrivilege 1868 wmic.exe Token: SeRemoteShutdownPrivilege 1868 wmic.exe Token: SeUndockPrivilege 1868 wmic.exe Token: SeManageVolumePrivilege 1868 wmic.exe Token: 33 1868 wmic.exe Token: 34 1868 wmic.exe Token: 35 1868 wmic.exe Token: 36 1868 wmic.exe Token: SeIncreaseQuotaPrivilege 1868 wmic.exe Token: SeSecurityPrivilege 1868 wmic.exe Token: SeTakeOwnershipPrivilege 1868 wmic.exe Token: SeLoadDriverPrivilege 1868 wmic.exe Token: SeSystemProfilePrivilege 1868 wmic.exe Token: SeSystemtimePrivilege 1868 wmic.exe Token: SeProfSingleProcessPrivilege 1868 wmic.exe Token: SeIncBasePriorityPrivilege 1868 wmic.exe Token: SeCreatePagefilePrivilege 1868 wmic.exe Token: SeBackupPrivilege 1868 wmic.exe Token: SeRestorePrivilege 1868 wmic.exe Token: SeShutdownPrivilege 1868 wmic.exe Token: SeDebugPrivilege 1868 wmic.exe Token: SeSystemEnvironmentPrivilege 1868 wmic.exe Token: SeRemoteShutdownPrivilege 1868 wmic.exe Token: SeUndockPrivilege 1868 wmic.exe Token: SeManageVolumePrivilege 1868 wmic.exe Token: 33 1868 wmic.exe Token: 34 1868 wmic.exe Token: 35 1868 wmic.exe Token: 36 1868 wmic.exe Token: SeShutdownPrivilege 1924 Umbral.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1868 1924 Umbral.exe 80 PID 1924 wrote to memory of 1868 1924 Umbral.exe 80