Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06-05-2024 12:00
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Umbral.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
232KB
-
MD5
afbe250f9d941daf1fc895e29d0b2821
-
SHA1
9aeaa55efa56702a0c2694ff2de3a5c6df7b03ac
-
SHA256
628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6
-
SHA512
177ddc51032af306d32c0826efddfa3be5e68621b440be764fba7ad37fd982fb58d7e902e4eb258fe50bbd236f82457e45e7d12a885c78314b304e72fb0f2c94
-
SSDEEP
6144:tloZMDXU9Zx0kt8X0/PSCsMpwpf3tW+x5R0STTKN0b8e1mKISi:voZnf0kkPQwpf3tW+x5R0STTKm2
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4140-1-0x0000026FD1AB0000-0x0000026FD1AF0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4140 Umbral.exe Token: SeIncreaseQuotaPrivilege 5032 wmic.exe Token: SeSecurityPrivilege 5032 wmic.exe Token: SeTakeOwnershipPrivilege 5032 wmic.exe Token: SeLoadDriverPrivilege 5032 wmic.exe Token: SeSystemProfilePrivilege 5032 wmic.exe Token: SeSystemtimePrivilege 5032 wmic.exe Token: SeProfSingleProcessPrivilege 5032 wmic.exe Token: SeIncBasePriorityPrivilege 5032 wmic.exe Token: SeCreatePagefilePrivilege 5032 wmic.exe Token: SeBackupPrivilege 5032 wmic.exe Token: SeRestorePrivilege 5032 wmic.exe Token: SeShutdownPrivilege 5032 wmic.exe Token: SeDebugPrivilege 5032 wmic.exe Token: SeSystemEnvironmentPrivilege 5032 wmic.exe Token: SeRemoteShutdownPrivilege 5032 wmic.exe Token: SeUndockPrivilege 5032 wmic.exe Token: SeManageVolumePrivilege 5032 wmic.exe Token: 33 5032 wmic.exe Token: 34 5032 wmic.exe Token: 35 5032 wmic.exe Token: 36 5032 wmic.exe Token: SeIncreaseQuotaPrivilege 5032 wmic.exe Token: SeSecurityPrivilege 5032 wmic.exe Token: SeTakeOwnershipPrivilege 5032 wmic.exe Token: SeLoadDriverPrivilege 5032 wmic.exe Token: SeSystemProfilePrivilege 5032 wmic.exe Token: SeSystemtimePrivilege 5032 wmic.exe Token: SeProfSingleProcessPrivilege 5032 wmic.exe Token: SeIncBasePriorityPrivilege 5032 wmic.exe Token: SeCreatePagefilePrivilege 5032 wmic.exe Token: SeBackupPrivilege 5032 wmic.exe Token: SeRestorePrivilege 5032 wmic.exe Token: SeShutdownPrivilege 5032 wmic.exe Token: SeDebugPrivilege 5032 wmic.exe Token: SeSystemEnvironmentPrivilege 5032 wmic.exe Token: SeRemoteShutdownPrivilege 5032 wmic.exe Token: SeUndockPrivilege 5032 wmic.exe Token: SeManageVolumePrivilege 5032 wmic.exe Token: 33 5032 wmic.exe Token: 34 5032 wmic.exe Token: 35 5032 wmic.exe Token: 36 5032 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4140 wrote to memory of 5032 4140 Umbral.exe 73 PID 4140 wrote to memory of 5032 4140 Umbral.exe 73