Analysis
-
max time kernel
46s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 13:01
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
243KB
-
MD5
7c28489ab3d43ced3c78f673e298e07c
-
SHA1
ae11b318d173b3f4a214c46d07b1301dc87fd30c
-
SHA256
2f25085b9c09c476013e70d58036ba70dc72815c5222be2018c4ef46a81222e1
-
SHA512
dd6dbba78ebcaefc2c7efb2dc28752f30aa5a604a7447ce2232f7b73bdc070782b2744ebd0a7f044414ac8a91e30cbde5c131af6647c1d45584a07fac9bf538e
-
SSDEEP
6144:ploZM8XU9Zx0kt8X0/PSCsMSl8kqNlOiLWU1pA1AoK28e1mpl48miP4fF:boZof0kkP/l8kqNlOiLWU1pABUl4KPKF
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/1188-0-0x0000019CD95E0000-0x0000019CD9622000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1188 Umbral.exe Token: SeIncreaseQuotaPrivilege 4088 wmic.exe Token: SeSecurityPrivilege 4088 wmic.exe Token: SeTakeOwnershipPrivilege 4088 wmic.exe Token: SeLoadDriverPrivilege 4088 wmic.exe Token: SeSystemProfilePrivilege 4088 wmic.exe Token: SeSystemtimePrivilege 4088 wmic.exe Token: SeProfSingleProcessPrivilege 4088 wmic.exe Token: SeIncBasePriorityPrivilege 4088 wmic.exe Token: SeCreatePagefilePrivilege 4088 wmic.exe Token: SeBackupPrivilege 4088 wmic.exe Token: SeRestorePrivilege 4088 wmic.exe Token: SeShutdownPrivilege 4088 wmic.exe Token: SeDebugPrivilege 4088 wmic.exe Token: SeSystemEnvironmentPrivilege 4088 wmic.exe Token: SeRemoteShutdownPrivilege 4088 wmic.exe Token: SeUndockPrivilege 4088 wmic.exe Token: SeManageVolumePrivilege 4088 wmic.exe Token: 33 4088 wmic.exe Token: 34 4088 wmic.exe Token: 35 4088 wmic.exe Token: 36 4088 wmic.exe Token: SeIncreaseQuotaPrivilege 4088 wmic.exe Token: SeSecurityPrivilege 4088 wmic.exe Token: SeTakeOwnershipPrivilege 4088 wmic.exe Token: SeLoadDriverPrivilege 4088 wmic.exe Token: SeSystemProfilePrivilege 4088 wmic.exe Token: SeSystemtimePrivilege 4088 wmic.exe Token: SeProfSingleProcessPrivilege 4088 wmic.exe Token: SeIncBasePriorityPrivilege 4088 wmic.exe Token: SeCreatePagefilePrivilege 4088 wmic.exe Token: SeBackupPrivilege 4088 wmic.exe Token: SeRestorePrivilege 4088 wmic.exe Token: SeShutdownPrivilege 4088 wmic.exe Token: SeDebugPrivilege 4088 wmic.exe Token: SeSystemEnvironmentPrivilege 4088 wmic.exe Token: SeRemoteShutdownPrivilege 4088 wmic.exe Token: SeUndockPrivilege 4088 wmic.exe Token: SeManageVolumePrivilege 4088 wmic.exe Token: 33 4088 wmic.exe Token: 34 4088 wmic.exe Token: 35 4088 wmic.exe Token: 36 4088 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4088 1188 Umbral.exe 88 PID 1188 wrote to memory of 4088 1188 Umbral.exe 88