umbral | e5da8ebc635776269ddceed41b6b6c0860071dafbe121b3fa17e63d01effd26c

General

Target

Umbral.exe
Size

231KB
MD5

e9e39a33854ca8af45f6048dd49f265b
SHA1

d19011ba34adf3135335aa9839d24e1b5c5dde71
SHA256

e5da8ebc635776269ddceed41b6b6c0860071dafbe121b3fa17e63d01effd26c
SHA512

703fdc9b9d086329a7273138920904fa0bf3d9917c0db74fcba1853bf1ecd42fd3144725238104e98ebac95f31da5d38551b3f97fb6c72ffdd0c60dbdc4d35cf
SSDEEP

6144:YOSAnvuqXLUirFMWyW1bYcUNSzNc0jqatc2J8e1mvSTU:vDqyFMWyW1bYcUNSzNc0jqIj2T

Score

10^/10

umbral execution stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4092-1-0x000001E7DF790000-0x000001E7DF7D0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4204 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

20 discord.com
22 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ip-api.com

flow	ioc
20	discord.com
22	discord.com

flow	ioc
18	ip-api.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

wmic.exe

pid process

4504 wmic.exe

pid	process
4504	wmic.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exetaskmgr.exe

pid	process
4204	powershell.exe
4204	powershell.exe
2260	powershell.exe
2260	powershell.exe
5036	powershell.exe
5036	powershell.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Umbral.exepowershell.exepowershell.exewmic.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	4092	Umbral.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeIncreaseQuotaPrivilege	32	wmic.exe
Token: SeSecurityPrivilege	32	wmic.exe
Token: SeTakeOwnershipPrivilege	32	wmic.exe
Token: SeLoadDriverPrivilege	32	wmic.exe
Token: SeSystemProfilePrivilege	32	wmic.exe
Token: SeSystemtimePrivilege	32	wmic.exe
Token: SeProfSingleProcessPrivilege	32	wmic.exe
Token: SeIncBasePriorityPrivilege	32	wmic.exe
Token: SeCreatePagefilePrivilege	32	wmic.exe
Token: SeBackupPrivilege	32	wmic.exe
Token: SeRestorePrivilege	32	wmic.exe
Token: SeShutdownPrivilege	32	wmic.exe
Token: SeDebugPrivilege	32	wmic.exe
Token: SeSystemEnvironmentPrivilege	32	wmic.exe
Token: SeRemoteShutdownPrivilege	32	wmic.exe
Token: SeUndockPrivilege	32	wmic.exe
Token: SeManageVolumePrivilege	32	wmic.exe
Token: 33	32	wmic.exe
Token: 34	32	wmic.exe
Token: 35	32	wmic.exe
Token: 36	32	wmic.exe
Token: SeIncreaseQuotaPrivilege	32	wmic.exe
Token: SeSecurityPrivilege	32	wmic.exe
Token: SeTakeOwnershipPrivilege	32	wmic.exe
Token: SeLoadDriverPrivilege	32	wmic.exe
Token: SeSystemProfilePrivilege	32	wmic.exe
Token: SeSystemtimePrivilege	32	wmic.exe
Token: SeProfSingleProcessPrivilege	32	wmic.exe
Token: SeIncBasePriorityPrivilege	32	wmic.exe
Token: SeCreatePagefilePrivilege	32	wmic.exe
Token: SeBackupPrivilege	32	wmic.exe
Token: SeRestorePrivilege	32	wmic.exe
Token: SeShutdownPrivilege	32	wmic.exe
Token: SeDebugPrivilege	32	wmic.exe
Token: SeSystemEnvironmentPrivilege	32	wmic.exe
Token: SeRemoteShutdownPrivilege	32	wmic.exe
Token: SeUndockPrivilege	32	wmic.exe
Token: SeManageVolumePrivilege	32	wmic.exe
Token: 33	32	wmic.exe
Token: 34	32	wmic.exe
Token: 35	32	wmic.exe
Token: 36	32	wmic.exe
Token: SeIncreaseQuotaPrivilege	1904	wmic.exe
Token: SeSecurityPrivilege	1904	wmic.exe
Token: SeTakeOwnershipPrivilege	1904	wmic.exe
Token: SeLoadDriverPrivilege	1904	wmic.exe
Token: SeSystemProfilePrivilege	1904	wmic.exe
Token: SeSystemtimePrivilege	1904	wmic.exe
Token: SeProfSingleProcessPrivilege	1904	wmic.exe
Token: SeIncBasePriorityPrivilege	1904	wmic.exe
Token: SeCreatePagefilePrivilege	1904	wmic.exe
Token: SeBackupPrivilege	1904	wmic.exe
Token: SeRestorePrivilege	1904	wmic.exe
Token: SeShutdownPrivilege	1904	wmic.exe
Token: SeDebugPrivilege	1904	wmic.exe
Token: SeSystemEnvironmentPrivilege	1904	wmic.exe
Token: SeRemoteShutdownPrivilege	1904	wmic.exe
Token: SeUndockPrivilege	1904	wmic.exe
Token: SeManageVolumePrivilege	1904	wmic.exe
Token: 33	1904	wmic.exe
Token: 34	1904	wmic.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

taskmgr.exe

pid	process
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of SendNotifyMessage 36 IoCs

Processes:

taskmgr.exe

pid	process
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Umbral.exe

description	pid	process	target process
PID 4092 wrote to memory of 4204	4092	Umbral.exe	powershell.exe
PID 4092 wrote to memory of 4204	4092	Umbral.exe	powershell.exe
PID 4092 wrote to memory of 2260	4092	Umbral.exe	powershell.exe
PID 4092 wrote to memory of 2260	4092	Umbral.exe	powershell.exe
PID 4092 wrote to memory of 32	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 32	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 1904	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 1904	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 1816	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 1816	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 5036	4092	Umbral.exe	powershell.exe
PID 4092 wrote to memory of 5036	4092	Umbral.exe	powershell.exe
PID 4092 wrote to memory of 4504	4092	Umbral.exe	wmic.exe
PID 4092 wrote to memory of 4504	4092	Umbral.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:32

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" computersystem get totalphysicalmemory
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
2⤵
PID:1816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036

C:\Windows\System32\Wbem\wmic.exe
"wmic" path win32_VideoController get name
2⤵
- Detects videocard installed
PID:4504

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
948B

MD5
df6c4e5c3091c14551e6c92f07717617

SHA1
1ea87111035496c1b2b74cef8b5c62d00ac072c9

SHA256
b79dc75372707ff84a643a9e4cff6fad2d1a936b54d458088850c62c96e2f231

SHA512
ab861efd0ff28a4bae3513a884d5b00c1b68d8f0bd54a00428bbb65a6954f8778e8f5300362025265251cb425c5ed77608b10776f382c3b392916ae46e38db35

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdlsaba3.jmu.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1664-62-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-63-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-64-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-65-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-66-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-61-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-60-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-55-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-56-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/1664-54-0x000001CF0A750000-0x000001CF0A751000-memory.dmp

Filesize
4KB

Download
memory/4092-37-0x000001E7E1480000-0x000001E7E149E000-memory.dmp

Filesize
120KB

Download
memory/4092-2-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4092-52-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/4092-53-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4092-36-0x000001E7FA120000-0x000001E7FA196000-memory.dmp

Filesize
472KB

Download
memory/4092-33-0x000001E7E1460000-0x000001E7E1472000-memory.dmp

Filesize
72KB

Download
memory/4092-32-0x000001E7E1410000-0x000001E7E141A000-memory.dmp

Filesize
40KB

Download
memory/4092-0-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/4092-1-0x000001E7DF790000-0x000001E7DF7D0000-memory.dmp

Filesize
256KB

Download
memory/4204-18-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-13-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-8-0x000001A719A10000-0x000001A719A32000-memory.dmp

Filesize
136KB

Download
memory/4204-14-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-15-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads