umbral | 628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe
Size 232KB
Sample240507-bqv3cseh82
SHA256 628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6
MD5 afbe250f9d941daf1fc895e29d0b2821
SHA1 9aeaa55efa56702a0c2694ff2de3a5c6df7b03ac
SHA512 177ddc51032af306d32c0826efddfa3be5e68621b440be764fba7ad37fd982fb58d7e902e4eb258fe50bbd236f82457e45e7d12a885c78314b304e72fb0f2c94
SSDEEP 6144:tloZMDXU9Zx0kt8X0/PSCsMpwpf3tW+x5R0STTKN0b8e1mKISi:voZnf0kkPQwpf3tW+x5R0STTKm2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

https://canary.discord.com/api/webhooks/1236998752988823573/NsiSmSiQW8IAMjpG8SIg_6Zkfz_FbtFHloBWpL6PbxmkMA2TAyh0tCrgXWEmC3ZyASfA

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
sample	family_umbral

Detects executables attemping to enumerate video devices using WMI 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Umbral family
umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe

File Explorer

628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe

.exe 232KB

628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6
MD5 afbe250f9d941daf1fc895e29d0b2821
SHA1 9aeaa55efa56702a0c2694ff2de3a5c6df7b03ac
SHA512 177ddc51032af306d32c0826efddfa3be5e68621b440be764fba7ad37fd982fb58d7e902e4eb258fe50bbd236f82457e45e7d12a885c78314b304e72fb0f2c94
SSDEEP 6144:tloZMDXU9Zx0kt8X0/PSCsMpwpf3tW+x5R0STTKN0b8e1mKISi:voZnf0kkPQwpf3tW+x5R0STTKm2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Umbral payload
Detects executables attemping to enumerate video devices using WMI
Detects executables containing possible sandbox analysis VM names
Detects executables containing possible sandbox analysis VM usernames
Detects executables containing possible sandbox system UUIDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

242830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

628d7cd6016b226c4e5e5252b29dc89e42d30ffebfb489e36857079aad591ce6.exe

mscoree

dotnet