511de5e8d2c4e482d2a5223ddc26a5f23faf320a392c20e9dfb38244704b6db8

Analysis

max time kernel
90s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
24-04-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Umbral.Steal by Ne-Amir.rar
Size

3.3MB
MD5

33ca3d89bd74dd5f252db702361fa472
SHA1

ec0abbebdcb6ac5b3f15b60e795edf4bc519e9a8
SHA256

511de5e8d2c4e482d2a5223ddc26a5f23faf320a392c20e9dfb38244704b6db8
SHA512

e97ac4be591e1670f68afb2ea5347dc9e05e3da10d64e52346912a65638e13377a18bfbe938f3633f9769e27b4d0f287f6619b7dadf891c592538dfe212a58ec
SSDEEP

49152:rSUnmThzebNJZUbhKG5iAcv6qAGBaqBgMB6zeR/cXgU0wHz5VP5vCKeR/JnTcmls:2Gm9eTkOv619M8CR/cXgULVPRYTT0ycZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

948 OpenWith.exe

pid	process
948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Umbral.Steal by Ne-Amir.rar"
1⤵
- Modifies registry class
PID:2540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:948

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads