General
-
Target
incognito.exe
-
Size
229KB
-
Sample
240531-vs799afa5z
-
MD5
a2e2e39f0f37c2bad057abd0d26da126
-
SHA1
644b65d488765656986b5f3607dac359e9955b27
-
SHA256
e4310f76275772aa2a6d4aa393a18a07e1ddb91ef6f2018cba717ba3478af322
-
SHA512
7be3fc42afae83211517c67cf9e1e87e463c5bffac89daac65f5b56353a29ab4a3a7573b6fa53c07357721ea980ce177c379dffe82967ba80ce8d0d298133e66
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD46oX8syVtGDTOMdRYYhb8e1mjEi:foZtL+EP86oX8syVtGDTOMdRY4K
Behavioral task
behavioral1
Sample
incognito.exe
Resource
win7-20240419-en
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1246079811550449737/o71DDSNevAp62v1h0lX5Zdz9PmOLjy45ti4wb_k8a16Uo5LJrfGyhDhSt-kejGs8Ti0E
Targets
-
-
Target
incognito.exe
-
Size
229KB
-
MD5
a2e2e39f0f37c2bad057abd0d26da126
-
SHA1
644b65d488765656986b5f3607dac359e9955b27
-
SHA256
e4310f76275772aa2a6d4aa393a18a07e1ddb91ef6f2018cba717ba3478af322
-
SHA512
7be3fc42afae83211517c67cf9e1e87e463c5bffac89daac65f5b56353a29ab4a3a7573b6fa53c07357721ea980ce177c379dffe82967ba80ce8d0d298133e66
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD46oX8syVtGDTOMdRYYhb8e1mjEi:foZtL+EP86oX8syVtGDTOMdRY4K
-
Detect Umbral payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Deletes itself
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-