Overview

overview

10

Static

static

10

9694195bfd...cs.exe

windows7-x64

10

9694195bfd...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9694195bfd2d5a2d219c548d8dc65cf0_NeikiAnalytics.exe

  • Size

    230KB

  • Sample

    240601-ll13xshh25

  • MD5

    9694195bfd2d5a2d219c548d8dc65cf0

  • SHA1

    d1113d97bb1114025e9260e898f3a3048a5a6fda

  • SHA256

    c58b3fa42e404b4a095ee2959a7975b392d7d6b6af6e4d11c1431e3a430dfb6e

  • SHA512

    24bb0f6432b221fe621d81a1c730bd473e9c295aa66a2b50cbe670ad2260f942a915f7f9aef65e6dc28320b8208fc712d9bfdc43dbc1a607ed9393bb5c17051a

  • SSDEEP

    6144:9loZM+rIkd8g+EtXHkv/iD4H/pduMzvExlwOffujfb8e1mYoi:foZtL+EP8H/pduMzvExlwOffuvZR

Score
10/10
umbralexecutionspywarestealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1241652478991269930/lqDzm5RXmNnZJ7VyPef0j8TTJEOPw48RTySfQrhy-HoHhnjd3f7_6UBfj32ly1VjvUlo

Targets

    • Target

      9694195bfd2d5a2d219c548d8dc65cf0_NeikiAnalytics.exe

    • Size

      230KB

    • MD5

      9694195bfd2d5a2d219c548d8dc65cf0

    • SHA1

      d1113d97bb1114025e9260e898f3a3048a5a6fda

    • SHA256

      c58b3fa42e404b4a095ee2959a7975b392d7d6b6af6e4d11c1431e3a430dfb6e

    • SHA512

      24bb0f6432b221fe621d81a1c730bd473e9c295aa66a2b50cbe670ad2260f942a915f7f9aef65e6dc28320b8208fc712d9bfdc43dbc1a607ed9393bb5c17051a

    • SSDEEP

      6144:9loZM+rIkd8g+EtXHkv/iD4H/pduMzvExlwOffujfb8e1mYoi:foZtL+EP8H/pduMzvExlwOffuvZR

    Score
    10/10
    umbralexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks