umbral | celex[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
celex.zip
Size 644KB
Sample240507-bg8xvsbe7x
SHA256 bd1077abb660d881bcd6d67997500ba2711898dd32c65d110d433876f42c7562
MD5 ba9b26dd146c97220dd13770bb29ecf0
SHA1 da0694215423d103512f45856fccc742e48951f2
SHA512 3e7f75ae38e388374ccd2dd251a5c5443ebf90cf34dcd49580f5532d89e8315106c17f4de79298eb2983a36aed35f186d23aad434c113a029ca1381295e13039
SSDEEP 12288:U0pT6kb1AvPO+U3KpUOUT6eLCaj1Sz0bTIQ+ceZiSl+XQS8r:U6T6kbsGK67T6eLBGlcegm+gS4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1157539550202175508/bMQmprnNW_YWr8QpVQ5zMXdWzlm3rfBo94XzDEmBz73xfPgW9fNPx7PlsrG8XSq9bHed

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
static1/unpack001/celex/celex.exe	family_umbral

Umbral family
umbral

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/celex/celex.dll
unpack001/celex/celex.exe

File Explorer

celex.zip

.zip 644KB
celex/celex.dll

.dll 1.1MB
celex/celex.exe

.exe 232KB
celex/changelog.json

111B

celex.zip

SHA256 bd1077abb660d881bcd6d67997500ba2711898dd32c65d110d433876f42c7562
MD5 ba9b26dd146c97220dd13770bb29ecf0
SHA1 da0694215423d103512f45856fccc742e48951f2
SHA512 3e7f75ae38e388374ccd2dd251a5c5443ebf90cf34dcd49580f5532d89e8315106c17f4de79298eb2983a36aed35f186d23aad434c113a029ca1381295e13039
SSDEEP 12288:U0pT6kb1AvPO+U3KpUOUT6eLCaj1Sz0bTIQ+ceZiSl+XQS8r:U6T6kbsGK67T6eLBGlcegm+gS4
MD5 SHA1 SHA512 SSDEEP

celex/celex.dll

IMPHASH 6e7e5d381cc623ce5195a0e19e7a699b
SHA256 49e2d50afd26e329be5fe0b6b56c2f499aa67c7ff3c6e07594f03490a44a3685
MD5 d91f8a8d5c8559744464d1109225b505
SHA1 6a8507f3fce19ef0aabe3c5919bd3670134b3f4f
SHA512 87e4ce1fa50abd01c497c499c876e45fbd5b8f6577cb994e0f3154893b8c2d0ef306b434ca430ef68bab8c2cf7477152ecaf4f4e546dd0bfbc9f992a66b17b5d
SSDEEP 24576:v5HGqEFgz/4cWN2hkvqWYWIPBK6DytDlrIAyqntGDojy:v5mq3zg/NQkjYWsYjntgx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

867780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\nick2\Desktop\celex-byfron\x64\Release\celex-byfron.pdb

normaliz

IdnToAscii

ws2_32

closesocket WSAResetEvent WSAGetLastError ntohs WSASetLastError WSAEventSelect WSAEnumNetworkEvents WSAStartup WSACleanup setsockopt WSAIoctl socket __WSAFDIsSet select accept bind connect getsockname htonl WSACreateEvent listen recv getaddrinfo freeaddrinfo recvfrom WSACloseEvent sendto getpeername ioctlsocket gethostname WSAWaitForMultipleEvents send getsockopt htons

wldap32

ord50 ord41 ord46 ord217 ord143 ord26 ord27 ord211 ord33 ord35 ord79 ord30 ord200 ord301 ord22 ord45 ord32 ord60

crypt32

CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CertCloseStore PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA CopySid IsValidSid OpenProcessToken GetLengthSid GetTokenInformation

kernel32

ResetEvent InitializeCriticalSectionAndSpinCount SetEvent RtlVirtualUnwind CreateEventW GetModuleHandleW RtlCaptureContext UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx OutputDebugStringW RtlLookupFunctionEntry ReadFile WriteFile PeekNamedPipe CreateFileW GetLastError CloseHandle GetCurrentProcessId MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter Sleep CreateFileA VirtualProtect GetProcessId CreateToolhelp32Snapshot QueryFullProcessImageNameA Module32FirstW GetFileSizeEx Module32NextW IsWow64Process VirtualQueryEx GetCurrentProcess HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW GetTickCount EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType WaitForMultipleObjects SleepEx VerifyVersionInfoW ReadProcessMemory

user32

MessageBoxA GetAsyncKeyState CallWindowProcA DefWindowProcA CreateWindowExA SetWindowLongPtrA RegisterClassExA FindWindowA SendInput GetKeyState LoadCursorA GetDC MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

gdi32

GetDeviceCaps

shell32

SHGetKnownFolderPath

msvcp140

?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?uncaught_exceptions@std@@YAHXZ ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??Bios_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Throw_C_error@std@@YAXH@Z _Mtx_destroy_in_situ _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Xtime_get_ticks ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Thrd_detach ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception memcmp memmove memchr strrchr __current_exception_context memcpy _CxxThrowException __C_specific_handler __std_exception_copy __std_exception_destroy strchr memset __std_type_info_destroy_list strstr __std_terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _fseeki64 fsetpos ungetc setvbuf fgetpos _lseeki64 fgets fputs fgetc _close fputc _write _read __stdio_common_vfprintf feof _open fopen __stdio_common_vsprintf_s _get_stream_buffer_pointers ftell __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fflush fclose fseek

api-ms-win-crt-heap-l1-1-0

realloc malloc free _callnewh calloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _initterm _initterm_e _invalid_parameter_noinfo_noreturn _beginthreadex _resetstkoflw exit _register_onexit_function _initialize_narrow_environment _invalid_parameter_noinfo system _errno _initialize_onexit_table _seh_filter_dll _configure_narrow_argv terminate __sys_nerr __sys_errlist _execute_onexit_table

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-string-l1-1-0

strncpy strcmp strncmp strpbrk tolower strspn strcspn _strdup

api-ms-win-crt-convert-l1-1-0

strtod wcstombs atof strtol strtoul atoi strtoull strtoll

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

sinf fmodf cosf ceilf acosf _dclass sqrtf _fdopen

api-ms-win-crt-filesystem-l1-1-0

_unlink _fstat64 _stat64 _unlock_file _lock_file _access

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

celex/celex.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9c6a028c15964ab83a35637a55e9738eec342d67f16c7c0d347b31f259e28629
MD5 c1e78a3d9c64ee73677e72545163c126
SHA1 28a33f173005ec78dc14c67d5b5761f4405243be
SHA512 a8e666fd43d72801db460ecced8ae5217442919b9b1b50b0efdaa5db1b3950dab5d20e6b6567d3463c0808b1b73d6bd40310a6e637a3b8de66b677bcb9ad01ad
SSDEEP 6144:rloZMLrIkd8g+EtXHkv/iD4ThFphv0IHg2PxM4dy+b8e1magci:poZ0L+EP8ThFphv0IHg2PxM4dpu1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Umbral payload
Unsigned PE

Checks for missing Authenticode signature.