Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-05-2024 12:00

General

  • Target

    Umbral.exe

  • Size

    232KB

  • MD5

    afbe250f9d941daf1fc895e29d0b2821

  • SHA1

    9aeaa55efa56702a0c2694ff2de3a5c6df7b03ac

  • SHA256

    628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6

  • SHA512

    177ddc51032af306d32c0826efddfa3be5e68621b440be764fba7ad37fd982fb58d7e902e4eb258fe50bbd236f82457e45e7d12a885c78314b304e72fb0f2c94

  • SSDEEP

    6144:tloZMDXU9Zx0kt8X0/PSCsMpwpf3tW+x5R0STTKN0b8e1mKISi:voZnf0kkPQwpf3tW+x5R0STTKm2

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1640-0-0x000007FEF51A3000-0x000007FEF51A4000-memory.dmp

    Filesize

    4KB

  • memory/1640-1-0x0000000001220000-0x0000000001260000-memory.dmp

    Filesize

    256KB

  • memory/1640-2-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/1640-3-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB