Analysis

  • max time kernel
    30s
  • max time network
    20s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-04-2024 20:12

General

  • Target

    Umbral.exe

  • Size

    230KB

  • MD5

    da7d94f96e8b7f035020b7721e968ec1

  • SHA1

    a30abe39a9e27e5eb76fb509eb4f9edeb7c36f5e

  • SHA256

    23d651ed623affcb1b71457c07c4f887a6ac44b04ceef74850292ab38d1b3287

  • SHA512

    181bf779331cbe6f456a44963004e84d8850e1a61350bae66c4e5001d185740c5fbab44b536e3e055871029db23409db376778488ea1d0098ac89786387bd6e2

  • SSDEEP

    3072:WP+1vofuiMY9QF1c7ROhOtXrLmBGIgXyPyTuuu5bO4ickEw8eFJMwT0kE/0RQ:lQ9Q4XYuTuuufS8eFJLhE

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Modifies Internet Explorer settings 1 TTPs 17 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    1⤵
      PID:1140
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\DisconnectConfirm.gif
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3192

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1140-0-0x000002C0D43B0000-0x000002C0D43F0000-memory.dmp

      Filesize

      256KB

    • memory/1140-1-0x00007FF8D0620000-0x00007FF8D10E1000-memory.dmp

      Filesize

      10.8MB

    • memory/1140-2-0x000002C0EE8F0000-0x000002C0EE900000-memory.dmp

      Filesize

      64KB

    • memory/1140-3-0x00007FF8D0620000-0x00007FF8D10E1000-memory.dmp

      Filesize

      10.8MB