umbral | ed5fe58c45c8b0e48c4c9405ba8065234090e19e145465117e0d2342f43fd872

Analysis

max time kernel
6s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krampus/b5uEJHZB6Rl.exe
Size

231KB
MD5

438289fb9c72ed39bf5497f9af21ec7a
SHA1

8120391ecb41ed6a4c6ef0b259776e59311d6997
SHA256

ea4cb7c7b4cfb2fcc04d1c3f96b20c26638e69a97b15cae14659f0d6afb78f85
SHA512

3647907fa2d503a242ef07cb20b081444b75e0c618a91232c8e77903b4b6aa823b8a7cbe07a45e02591fe48fdd23b5eae88565006b85863c0a5f6e42d7589fe0
SSDEEP

6144:YloZM+rIkd8g+EtXHkv/iD4Bs4DdLocD/abtIEx6tb8e1mTiu:GoZtL+EP8Bs4DdLocD/abtIExq1

Score

10^/10

umbral spyware stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/2092-0-0x000001DD8E4A0000-0x000001DD8E4E0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	b5uEJHZB6Rl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2296	wmic.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2092	b5uEJHZB6Rl.exe
2824	powershell.exe
2824	powershell.exe
5052	powershell.exe
5052	powershell.exe
3572	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	b5uEJHZB6Rl.exe
Token: SeIncreaseQuotaPrivilege	3368	wmic.exe
Token: SeSecurityPrivilege	3368	wmic.exe
Token: SeTakeOwnershipPrivilege	3368	wmic.exe
Token: SeLoadDriverPrivilege	3368	wmic.exe
Token: SeSystemProfilePrivilege	3368	wmic.exe
Token: SeSystemtimePrivilege	3368	wmic.exe
Token: SeProfSingleProcessPrivilege	3368	wmic.exe
Token: SeIncBasePriorityPrivilege	3368	wmic.exe
Token: SeCreatePagefilePrivilege	3368	wmic.exe
Token: SeBackupPrivilege	3368	wmic.exe
Token: SeRestorePrivilege	3368	wmic.exe
Token: SeShutdownPrivilege	3368	wmic.exe
Token: SeDebugPrivilege	3368	wmic.exe
Token: SeSystemEnvironmentPrivilege	3368	wmic.exe
Token: SeRemoteShutdownPrivilege	3368	wmic.exe
Token: SeUndockPrivilege	3368	wmic.exe
Token: SeManageVolumePrivilege	3368	wmic.exe
Token: 33	3368	wmic.exe
Token: 34	3368	wmic.exe
Token: 35	3368	wmic.exe
Token: 36	3368	wmic.exe
Token: SeIncreaseQuotaPrivilege	3368	wmic.exe
Token: SeSecurityPrivilege	3368	wmic.exe
Token: SeTakeOwnershipPrivilege	3368	wmic.exe
Token: SeLoadDriverPrivilege	3368	wmic.exe
Token: SeSystemProfilePrivilege	3368	wmic.exe
Token: SeSystemtimePrivilege	3368	wmic.exe
Token: SeProfSingleProcessPrivilege	3368	wmic.exe
Token: SeIncBasePriorityPrivilege	3368	wmic.exe
Token: SeCreatePagefilePrivilege	3368	wmic.exe
Token: SeBackupPrivilege	3368	wmic.exe
Token: SeRestorePrivilege	3368	wmic.exe
Token: SeShutdownPrivilege	3368	wmic.exe
Token: SeDebugPrivilege	3368	wmic.exe
Token: SeSystemEnvironmentPrivilege	3368	wmic.exe
Token: SeRemoteShutdownPrivilege	3368	wmic.exe
Token: SeUndockPrivilege	3368	wmic.exe
Token: SeManageVolumePrivilege	3368	wmic.exe
Token: 33	3368	wmic.exe
Token: 34	3368	wmic.exe
Token: 35	3368	wmic.exe
Token: 36	3368	wmic.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3368	2092	b5uEJHZB6Rl.exe	81
PID 2092 wrote to memory of 3368	2092	b5uEJHZB6Rl.exe	81
PID 2092 wrote to memory of 1136	2092	b5uEJHZB6Rl.exe	84
PID 2092 wrote to memory of 1136	2092	b5uEJHZB6Rl.exe	84
PID 2092 wrote to memory of 2824	2092	b5uEJHZB6Rl.exe	86
PID 2092 wrote to memory of 2824	2092	b5uEJHZB6Rl.exe	86
PID 2092 wrote to memory of 5052	2092	b5uEJHZB6Rl.exe	88
PID 2092 wrote to memory of 5052	2092	b5uEJHZB6Rl.exe	88
PID 2092 wrote to memory of 3572	2092	b5uEJHZB6Rl.exe	90
PID 2092 wrote to memory of 3572	2092	b5uEJHZB6Rl.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1136	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe
"C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe"
  2⤵
  - Views/modifies file attributes
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:1152
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:4472
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2364
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  PID:2016
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
21afec55047674edd150dc516f1c851e

SHA1
e4b709d2bfaf132bd729e61b9740948dffaffa90

SHA256
43844e938dc4b56a86c4aedec50551f4771076cdcd2033416f6194a9bc84a951

SHA512
63e12c9a9e783494d86c09f1a5bf151a311e789beefcdc1ab86d7e485bc97ecbdf609f6933a0f59243d4198b4483d1ebabc4aa42734f81f2a1785c59c8281510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
441a842138038e6385e430a90d7ea608

SHA1
7b3712d2cdd37e10ee9b3994131ee5175e920f01

SHA256
47592f3324179912d3bdba336b9e75568c2c5f1a9fb37c1ba9f0db9df822164c

SHA512
9dbddc3216f2a132ae3961b3aeac2c5b8828dcc9292f6c5bf1171c47453aa8687f92658818d771413492c0ea565e9ede17b9c03e427af9dc2ac21a78369a6666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e8ad350bb24c7ab38efd0ef0553239c7

SHA1
887c19e4c11de19854458e26a1ed05b67a75bf29

SHA256
5cf85b38cbbf1a064a4f8001a0ec031993d44e46b8e65d713785c84916cb8ffd

SHA512
74fef147e98b8b576712c212174a7793deb619d54c7ac7956e38ed4e09202f0c93ae4ec9e89cd4d0ac79c481d30c5c3fc5a3d042537c74d7bffda1f8453aef6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jib5u2fi.orh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1152-81-0x000001FFBFE90000-0x000001FFBFEA0000-memory.dmp

Filesize
64KB

Download
memory/1152-78-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/1152-84-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/1152-79-0x000001FFBFE90000-0x000001FFBFEA0000-memory.dmp

Filesize
64KB

Download
memory/1152-82-0x000001FFBFE90000-0x000001FFBFEA0000-memory.dmp

Filesize
64KB

Download
memory/2016-104-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/2016-102-0x0000023863350000-0x0000023863360000-memory.dmp

Filesize
64KB

Download
memory/2016-92-0x0000023863350000-0x0000023863360000-memory.dmp

Filesize
64KB

Download
memory/2016-91-0x0000023863350000-0x0000023863360000-memory.dmp

Filesize
64KB

Download
memory/2016-90-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/2092-33-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/2092-54-0x000001DDA8AF0000-0x000001DDA8B00000-memory.dmp

Filesize
64KB

Download
memory/2092-1-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/2092-39-0x000001DDA8C80000-0x000001DDA8CF6000-memory.dmp

Filesize
472KB

Download
memory/2092-40-0x000001DDA8D00000-0x000001DDA8D50000-memory.dmp

Filesize
320KB

Download
memory/2092-41-0x000001DDA8AD0000-0x000001DDA8AEE000-memory.dmp

Filesize
120KB

Download
memory/2092-86-0x000001DDA8C20000-0x000001DDA8C2A000-memory.dmp

Filesize
40KB

Download
memory/2092-87-0x000001DDA8C50000-0x000001DDA8C62000-memory.dmp

Filesize
72KB

Download
memory/2092-2-0x000001DDA8AF0000-0x000001DDA8B00000-memory.dmp

Filesize
64KB

Download
memory/2092-0-0x000001DD8E4A0000-0x000001DD8E4E0000-memory.dmp

Filesize
256KB

Download
memory/2824-14-0x000001552DAA0000-0x000001552DAB0000-memory.dmp

Filesize
64KB

Download
memory/2824-12-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/2824-15-0x000001552DAA0000-0x000001552DAB0000-memory.dmp

Filesize
64KB

Download
memory/2824-18-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/2824-11-0x0000015515430000-0x0000015515452000-memory.dmp

Filesize
136KB

Download
memory/2824-13-0x000001552DAA0000-0x000001552DAB0000-memory.dmp

Filesize
64KB

Download
memory/3572-52-0x000002953A230000-0x000002953A240000-memory.dmp

Filesize
64KB

Download
memory/3572-51-0x000002953A230000-0x000002953A240000-memory.dmp

Filesize
64KB

Download
memory/3572-50-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/3572-67-0x000002953A230000-0x000002953A240000-memory.dmp

Filesize
64KB

Download
memory/3572-69-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/5052-32-0x00000187BBC10000-0x00000187BBC20000-memory.dmp

Filesize
64KB

Download
memory/5052-22-0x00000187BBC10000-0x00000187BBC20000-memory.dmp

Filesize
64KB

Download
memory/5052-21-0x00000187BBC10000-0x00000187BBC20000-memory.dmp

Filesize
64KB

Download
memory/5052-20-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/5052-36-0x00007FFA17760000-0x00007FFA18222000-memory.dmp

Filesize
10.8MB

Download
memory/5052-34-0x00000187BBC10000-0x00000187BBC20000-memory.dmp

Filesize
64KB

Download