umbral

General

Target

Client1.exe
Size

747KB
Sample

240527-pryfrscc3t
MD5

c8d8bf0cef0eb986664a7653b30062b6
SHA1

da1957c3bcd76a71d8182fd42a677e5aeaf76cde
SHA256

e3b98f944dd0cf41f0955cbc2b8858d249a39f69568ea82286d14e20d8e9c910
SHA512

34278aee895a03cd76b56278c5b362aa013d83f8be355fd5fdac442e19eaf5a60477f317cdeac157ba69785661866ff41d6051c1cb40ecb473c2814c5d0c672a
SSDEEP

12288:+cWW/gSKBvPVle8c6bn3VG0jMRxPjT90n/4mhBE:+CNEVXePjT90ww

Score

10^/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1243097311723393148/0kJSMmx_-19_4524KFq8Hz7UKUelS_Uh7rQ6mExsss1TqjKf8JjJJVNCnPnFTM52o-iH

Targets

- Target
  
  Client1.exe
- Size
  
  747KB
- MD5
  
  c8d8bf0cef0eb986664a7653b30062b6
- SHA1
  
  da1957c3bcd76a71d8182fd42a677e5aeaf76cde
- SHA256
  
  e3b98f944dd0cf41f0955cbc2b8858d249a39f69568ea82286d14e20d8e9c910
- SHA512
  
  34278aee895a03cd76b56278c5b362aa013d83f8be355fd5fdac442e19eaf5a60477f317cdeac157ba69785661866ff41d6051c1cb40ecb473c2814c5d0c672a
- SSDEEP
  
  12288:+cWW/gSKBvPVle8c6bn3VG0jMRxPjT90n/4mhBE:+CNEVXePjT90ww
Score

10^/10

umbral bootkit evasion execution persistence spyware stealer
- Detect Umbral payload
- Modifies WinLogon for persistence
  persistence
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  evasion
- Disables cmd.exe use via registry modification
  evasion
- Drops file in Drivers directory
- Modifies AppInit DLL entries
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1