Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 13:01
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
243KB
-
MD5
7c28489ab3d43ced3c78f673e298e07c
-
SHA1
ae11b318d173b3f4a214c46d07b1301dc87fd30c
-
SHA256
2f25085b9c09c476013e70d58036ba70dc72815c5222be2018c4ef46a81222e1
-
SHA512
dd6dbba78ebcaefc2c7efb2dc28752f30aa5a604a7447ce2232f7b73bdc070782b2744ebd0a7f044414ac8a91e30cbde5c131af6647c1d45584a07fac9bf538e
-
SSDEEP
6144:ploZM8XU9Zx0kt8X0/PSCsMSl8kqNlOiLWU1pA1AoK28e1mpl48miP4fF:boZof0kkP/l8kqNlOiLWU1pABUl4KPKF
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2108-0-0x0000000000E30000-0x0000000000E72000-memory.dmp family_umbral behavioral1/memory/2108-2-0x000000001A8E0000-0x000000001A960000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2108 Umbral.exe Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2504 2108 Umbral.exe 28 PID 2108 wrote to memory of 2504 2108 Umbral.exe 28 PID 2108 wrote to memory of 2504 2108 Umbral.exe 28