umbral | 455784b6d8edafa34ac88e20d2ca34a8e26d6ae8c89fc77875c856feab347ef3

Resubmissions

15-04-2024 16:39

240415-t5y2nsba78 10

15-04-2024 16:36

240415-t4jwcsba49 10

Analysis

max time kernel
123s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Velonity.exe
Size

1.2MB
MD5

acfe7dcbe9723382722bcdf52bbb73e8
SHA1

b60644750f40d2ee4052c8e6dd588ad99288bc6f
SHA256

455784b6d8edafa34ac88e20d2ca34a8e26d6ae8c89fc77875c856feab347ef3
SHA512

841e20a08f6c59c3162a3fd4e6d44276c0025c7cc75261e481c21a4b4df629c5d603c4bda3d6f927ac24186d4a3fd162ec5e2d05c97528b37e8cf9efc4d530cb
SSDEEP

24576:vDM2Ny922wrKSFocmJgYV1lJ544YcRgbJhf1foTh9ZCLzAxy+7:rzeEWSFoDg45gbJ30h9ZJy

Score

10^/10

umbral stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1226889417617309827/aGM_hNDP-J3NT9u8SNSCocRMlBp_FCEGgjkp6sBXd1GO8FD5GFf_AHKBNovo138ckADt

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/memory/1136-2-0x0000000000DB0000-0x0000000001188000-memory.dmp	family_umbral
behavioral1/memory/1136-4-0x0000000000DB0000-0x0000000001188000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1136	Velonity.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.vdw\ = "vdw_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vdw_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vdw_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.vdw	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vdw_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vdw_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vdw_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vdw_auto_file\	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1148	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1148	vlc.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	Velonity.exe
Token: SeIncreaseQuotaPrivilege	2632	wmic.exe
Token: SeSecurityPrivilege	2632	wmic.exe
Token: SeTakeOwnershipPrivilege	2632	wmic.exe
Token: SeLoadDriverPrivilege	2632	wmic.exe
Token: SeSystemProfilePrivilege	2632	wmic.exe
Token: SeSystemtimePrivilege	2632	wmic.exe
Token: SeProfSingleProcessPrivilege	2632	wmic.exe
Token: SeIncBasePriorityPrivilege	2632	wmic.exe
Token: SeCreatePagefilePrivilege	2632	wmic.exe
Token: SeBackupPrivilege	2632	wmic.exe
Token: SeRestorePrivilege	2632	wmic.exe
Token: SeShutdownPrivilege	2632	wmic.exe
Token: SeDebugPrivilege	2632	wmic.exe
Token: SeSystemEnvironmentPrivilege	2632	wmic.exe
Token: SeRemoteShutdownPrivilege	2632	wmic.exe
Token: SeUndockPrivilege	2632	wmic.exe
Token: SeManageVolumePrivilege	2632	wmic.exe
Token: 33	2632	wmic.exe
Token: 34	2632	wmic.exe
Token: 35	2632	wmic.exe
Token: SeIncreaseQuotaPrivilege	2632	wmic.exe
Token: SeSecurityPrivilege	2632	wmic.exe
Token: SeTakeOwnershipPrivilege	2632	wmic.exe
Token: SeLoadDriverPrivilege	2632	wmic.exe
Token: SeSystemProfilePrivilege	2632	wmic.exe
Token: SeSystemtimePrivilege	2632	wmic.exe
Token: SeProfSingleProcessPrivilege	2632	wmic.exe
Token: SeIncBasePriorityPrivilege	2632	wmic.exe
Token: SeCreatePagefilePrivilege	2632	wmic.exe
Token: SeBackupPrivilege	2632	wmic.exe
Token: SeRestorePrivilege	2632	wmic.exe
Token: SeShutdownPrivilege	2632	wmic.exe
Token: SeDebugPrivilege	2632	wmic.exe
Token: SeSystemEnvironmentPrivilege	2632	wmic.exe
Token: SeRemoteShutdownPrivilege	2632	wmic.exe
Token: SeUndockPrivilege	2632	wmic.exe
Token: SeManageVolumePrivilege	2632	wmic.exe
Token: 33	2632	wmic.exe
Token: 34	2632	wmic.exe
Token: 35	2632	wmic.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe
1148	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1136	Velonity.exe
2324	AcroRd32.exe
2324	AcroRd32.exe
1148	vlc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2632	1136	Velonity.exe	28
PID 1136 wrote to memory of 2632	1136	Velonity.exe	28
PID 1136 wrote to memory of 2632	1136	Velonity.exe	28
PID 1136 wrote to memory of 2632	1136	Velonity.exe	28
PID 1128 wrote to memory of 2324	1128	rundll32.exe	34
PID 1128 wrote to memory of 2324	1128	rundll32.exe	34
PID 1128 wrote to memory of 2324	1128	rundll32.exe	34
PID 1128 wrote to memory of 2324	1128	rundll32.exe	34

C:\Users\Admin\AppData\Local\Temp\Velonity.exe
"C:\Users\Admin\AppData\Local\Temp\Velonity.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2632

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\StepHide.vdw
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\StepHide.vdw"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2324

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnpublishGet.ADT"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-0-0x0000000000DB0000-0x0000000001188000-memory.dmp

Filesize
3.8MB

Download
memory/1136-2-0x0000000000DB0000-0x0000000001188000-memory.dmp

Filesize
3.8MB

Download
memory/1136-1-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1136-3-0x0000000005900000-0x0000000005940000-memory.dmp

Filesize
256KB

Download
memory/1136-4-0x0000000000DB0000-0x0000000001188000-memory.dmp

Filesize
3.8MB

Download
memory/1136-5-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1148-18-0x000000013F290000-0x000000013F388000-memory.dmp

Filesize
992KB

Download
memory/1148-19-0x000007FEF7960000-0x000007FEF7994000-memory.dmp

Filesize
208KB

Download
memory/1148-20-0x000007FEF6040000-0x000007FEF62F4000-memory.dmp

Filesize
2.7MB

Download
memory/1148-21-0x000007FEF4830000-0x000007FEF58DB000-memory.dmp

Filesize
16.7MB

Download
memory/1148-22-0x000007FEF4270000-0x000007FEF4382000-memory.dmp

Filesize
1.1MB

Download