umbral | 455784b6d8edafa34ac88e20d2ca34a8e26d6ae8c89fc77875c856feab347ef3

Resubmissions

15-04-2024 16:39

240415-t5y2nsba78 10

15-04-2024 16:36

240415-t4jwcsba49 10

Analysis

max time kernel
43s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Velonity.exe
Size

1.2MB
MD5

acfe7dcbe9723382722bcdf52bbb73e8
SHA1

b60644750f40d2ee4052c8e6dd588ad99288bc6f
SHA256

455784b6d8edafa34ac88e20d2ca34a8e26d6ae8c89fc77875c856feab347ef3
SHA512

841e20a08f6c59c3162a3fd4e6d44276c0025c7cc75261e481c21a4b4df629c5d603c4bda3d6f927ac24186d4a3fd162ec5e2d05c97528b37e8cf9efc4d530cb
SSDEEP

24576:vDM2Ny922wrKSFocmJgYV1lJ544YcRgbJhf1foTh9ZCLzAxy+7:rzeEWSFoDg45gbJ30h9ZJy

Score

10^/10

umbral stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1226889417617309827/aGM_hNDP-J3NT9u8SNSCocRMlBp_FCEGgjkp6sBXd1GO8FD5GFf_AHKBNovo138ckADt

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/memory/2020-2-0x0000000000BB0000-0x0000000000F88000-memory.dmp	family_umbral
behavioral1/memory/2020-3-0x0000000000BB0000-0x0000000000F88000-memory.dmp	family_umbral
behavioral1/memory/2020-5-0x0000000000BB0000-0x0000000000F88000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2020	Velonity.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	Velonity.exe
Token: SeIncreaseQuotaPrivilege	2644	wmic.exe
Token: SeSecurityPrivilege	2644	wmic.exe
Token: SeTakeOwnershipPrivilege	2644	wmic.exe
Token: SeLoadDriverPrivilege	2644	wmic.exe
Token: SeSystemProfilePrivilege	2644	wmic.exe
Token: SeSystemtimePrivilege	2644	wmic.exe
Token: SeProfSingleProcessPrivilege	2644	wmic.exe
Token: SeIncBasePriorityPrivilege	2644	wmic.exe
Token: SeCreatePagefilePrivilege	2644	wmic.exe
Token: SeBackupPrivilege	2644	wmic.exe
Token: SeRestorePrivilege	2644	wmic.exe
Token: SeShutdownPrivilege	2644	wmic.exe
Token: SeDebugPrivilege	2644	wmic.exe
Token: SeSystemEnvironmentPrivilege	2644	wmic.exe
Token: SeRemoteShutdownPrivilege	2644	wmic.exe
Token: SeUndockPrivilege	2644	wmic.exe
Token: SeManageVolumePrivilege	2644	wmic.exe
Token: 33	2644	wmic.exe
Token: 34	2644	wmic.exe
Token: 35	2644	wmic.exe
Token: SeIncreaseQuotaPrivilege	2644	wmic.exe
Token: SeSecurityPrivilege	2644	wmic.exe
Token: SeTakeOwnershipPrivilege	2644	wmic.exe
Token: SeLoadDriverPrivilege	2644	wmic.exe
Token: SeSystemProfilePrivilege	2644	wmic.exe
Token: SeSystemtimePrivilege	2644	wmic.exe
Token: SeProfSingleProcessPrivilege	2644	wmic.exe
Token: SeIncBasePriorityPrivilege	2644	wmic.exe
Token: SeCreatePagefilePrivilege	2644	wmic.exe
Token: SeBackupPrivilege	2644	wmic.exe
Token: SeRestorePrivilege	2644	wmic.exe
Token: SeShutdownPrivilege	2644	wmic.exe
Token: SeDebugPrivilege	2644	wmic.exe
Token: SeSystemEnvironmentPrivilege	2644	wmic.exe
Token: SeRemoteShutdownPrivilege	2644	wmic.exe
Token: SeUndockPrivilege	2644	wmic.exe
Token: SeManageVolumePrivilege	2644	wmic.exe
Token: 33	2644	wmic.exe
Token: 34	2644	wmic.exe
Token: 35	2644	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2020	Velonity.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2644	2020	Velonity.exe	28
PID 2020 wrote to memory of 2644	2020	Velonity.exe	28
PID 2020 wrote to memory of 2644	2020	Velonity.exe	28
PID 2020 wrote to memory of 2644	2020	Velonity.exe	28

C:\Users\Admin\AppData\Local\Temp\Velonity.exe
"C:\Users\Admin\AppData\Local\Temp\Velonity.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-0-0x0000000000BB0000-0x0000000000F88000-memory.dmp

Filesize
3.8MB

Download
memory/2020-1-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2020-2-0x0000000000BB0000-0x0000000000F88000-memory.dmp

Filesize
3.8MB

Download
memory/2020-3-0x0000000000BB0000-0x0000000000F88000-memory.dmp

Filesize
3.8MB

Download
memory/2020-4-0x0000000006430000-0x0000000006470000-memory.dmp

Filesize
256KB

Download
memory/2020-5-0x0000000000BB0000-0x0000000000F88000-memory.dmp

Filesize
3.8MB

Download
memory/2020-6-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download