Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 20:19
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
dd294f4a30b78637d2de6ae794442508
-
SHA1
2f28200fb482bb7f280ecde35070b8bf181900ef
-
SHA256
a89f3d297cbac8b605cd554dd0ea7891c7fcff9e63c7c22810d1c8121fd128b1
-
SHA512
cc4343ab3d9dc6f6eb8312a28df24442280144d3c54fe3fca65412b6285ae98c264a67a70a86b1fd73418bee535ea5adbe968e7b48a40ad833beaabf459d7bf5
-
SSDEEP
6144:1loZMLrIkd8g+EtXHkv/iD4n9ruuMzvERlwOffu2/b8e1mR6i:XoZ0L+EP8n9ruuMzvERlwOffuYK
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2180-0-0x000001D0D3C90000-0x000001D0D3CD0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4864 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 37 discord.com 38 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5012 wmic.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2180 Umbral.exe 4864 powershell.exe 4864 powershell.exe 3728 powershell.exe 3728 powershell.exe 1520 powershell.exe 1520 powershell.exe 1408 powershell.exe 1408 powershell.exe 2412 powershell.exe 2412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2180 Umbral.exe Token: SeIncreaseQuotaPrivilege 4716 wmic.exe Token: SeSecurityPrivilege 4716 wmic.exe Token: SeTakeOwnershipPrivilege 4716 wmic.exe Token: SeLoadDriverPrivilege 4716 wmic.exe Token: SeSystemProfilePrivilege 4716 wmic.exe Token: SeSystemtimePrivilege 4716 wmic.exe Token: SeProfSingleProcessPrivilege 4716 wmic.exe Token: SeIncBasePriorityPrivilege 4716 wmic.exe Token: SeCreatePagefilePrivilege 4716 wmic.exe Token: SeBackupPrivilege 4716 wmic.exe Token: SeRestorePrivilege 4716 wmic.exe Token: SeShutdownPrivilege 4716 wmic.exe Token: SeDebugPrivilege 4716 wmic.exe Token: SeSystemEnvironmentPrivilege 4716 wmic.exe Token: SeRemoteShutdownPrivilege 4716 wmic.exe Token: SeUndockPrivilege 4716 wmic.exe Token: SeManageVolumePrivilege 4716 wmic.exe Token: 33 4716 wmic.exe Token: 34 4716 wmic.exe Token: 35 4716 wmic.exe Token: 36 4716 wmic.exe Token: SeIncreaseQuotaPrivilege 4716 wmic.exe Token: SeSecurityPrivilege 4716 wmic.exe Token: SeTakeOwnershipPrivilege 4716 wmic.exe Token: SeLoadDriverPrivilege 4716 wmic.exe Token: SeSystemProfilePrivilege 4716 wmic.exe Token: SeSystemtimePrivilege 4716 wmic.exe Token: SeProfSingleProcessPrivilege 4716 wmic.exe Token: SeIncBasePriorityPrivilege 4716 wmic.exe Token: SeCreatePagefilePrivilege 4716 wmic.exe Token: SeBackupPrivilege 4716 wmic.exe Token: SeRestorePrivilege 4716 wmic.exe Token: SeShutdownPrivilege 4716 wmic.exe Token: SeDebugPrivilege 4716 wmic.exe Token: SeSystemEnvironmentPrivilege 4716 wmic.exe Token: SeRemoteShutdownPrivilege 4716 wmic.exe Token: SeUndockPrivilege 4716 wmic.exe Token: SeManageVolumePrivilege 4716 wmic.exe Token: 33 4716 wmic.exe Token: 34 4716 wmic.exe Token: 35 4716 wmic.exe Token: 36 4716 wmic.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 3728 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeIncreaseQuotaPrivilege 3980 wmic.exe Token: SeSecurityPrivilege 3980 wmic.exe Token: SeTakeOwnershipPrivilege 3980 wmic.exe Token: SeLoadDriverPrivilege 3980 wmic.exe Token: SeSystemProfilePrivilege 3980 wmic.exe Token: SeSystemtimePrivilege 3980 wmic.exe Token: SeProfSingleProcessPrivilege 3980 wmic.exe Token: SeIncBasePriorityPrivilege 3980 wmic.exe Token: SeCreatePagefilePrivilege 3980 wmic.exe Token: SeBackupPrivilege 3980 wmic.exe Token: SeRestorePrivilege 3980 wmic.exe Token: SeShutdownPrivilege 3980 wmic.exe Token: SeDebugPrivilege 3980 wmic.exe Token: SeSystemEnvironmentPrivilege 3980 wmic.exe Token: SeRemoteShutdownPrivilege 3980 wmic.exe Token: SeUndockPrivilege 3980 wmic.exe Token: SeManageVolumePrivilege 3980 wmic.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2180 wrote to memory of 4716 2180 Umbral.exe 84 PID 2180 wrote to memory of 4716 2180 Umbral.exe 84 PID 2180 wrote to memory of 4864 2180 Umbral.exe 87 PID 2180 wrote to memory of 4864 2180 Umbral.exe 87 PID 2180 wrote to memory of 3728 2180 Umbral.exe 90 PID 2180 wrote to memory of 3728 2180 Umbral.exe 90 PID 2180 wrote to memory of 1520 2180 Umbral.exe 94 PID 2180 wrote to memory of 1520 2180 Umbral.exe 94 PID 2180 wrote to memory of 1408 2180 Umbral.exe 96 PID 2180 wrote to memory of 1408 2180 Umbral.exe 96 PID 2180 wrote to memory of 3980 2180 Umbral.exe 100 PID 2180 wrote to memory of 3980 2180 Umbral.exe 100 PID 2180 wrote to memory of 2368 2180 Umbral.exe 102 PID 2180 wrote to memory of 2368 2180 Umbral.exe 102 PID 2180 wrote to memory of 116 2180 Umbral.exe 104 PID 2180 wrote to memory of 116 2180 Umbral.exe 104 PID 2180 wrote to memory of 2412 2180 Umbral.exe 106 PID 2180 wrote to memory of 2412 2180 Umbral.exe 106 PID 2180 wrote to memory of 5012 2180 Umbral.exe 109 PID 2180 wrote to memory of 5012 2180 Umbral.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2368
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:5012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
948B
MD51a58f982c18490e622e00d4eb75ace5a
SHA160c30527b74659ecf09089a5a7c02a1df9a71b65
SHA2564b7f800c0dea209162cc86627983993127eb20e3f8616646c41cb3ce15d9b39d
SHA512ddab516a967783c5951717853aa5b3ef6dd5b442db50092888b2e7f3179fc68120fcde69a08d6ab280740eaadb6eadfc758c3118b52706f869e48ac1aebda480
-
Filesize
1KB
MD5d3235ed022a42ec4338123ab87144afa
SHA15058608bc0deb720a585a2304a8f7cf63a50a315
SHA25610663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27
SHA512236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf
-
Filesize
1KB
MD5401e2433ba6338e47aa49b1d254fae92
SHA1ccde8ccf7ab162f2c286b0fade504b794bf9e48e
SHA2567f511887994094051fafd009ae9b8974f7ae5ec28306ed6aa4ec54dadfd12b55
SHA512e5fed80d17b8afaad388634863d7c64730949c462b59027bca8f6a80113895a00c135557ffcb1f3a3e7f11734ee257a05c4c69482334b372e2cbc66c4c43669d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82