Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 18:10
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
ac6dc91bec5d51b9b8f7b36642f875db
-
SHA1
ebf088795549ec27047225f14b3263c7b022168e
-
SHA256
cb32d0fc4534e19ae8009edacbe41b2aac5755b8c7bf233fd4c9b39a00f9b318
-
SHA512
d44f953ea4aac986c5eea7242ad0d0b6143117781ab9f35537523ad0f4cf95b23c5aeb223ba74febba96afd9006b3f20edbc2bba2113661aa6d56368c93598da
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4qacRCg/7IER0STTKreb8e1mHi:voZtL+EP8qacRCg/7IER0STTK2Z
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4768-0-0x000001FE32250000-0x000001FE32290000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4768 Umbral.exe