Overview

overview

10

Static

static

3

aa.exe

windows7-x64

10

aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 12:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa.exe

  • Size

    1.4MB

  • MD5

    de2363f6703a0bf9383d60ab1bd4f373

  • SHA1

    aaa94c5937f11dbb8d376d94f142986e228f9bb8

  • SHA256

    53d7972fc0f8be77d6f3b16368a97f76a50149bc91a448213ddae10b87776efa

  • SHA512

    f01a6cfeb385560544704e040d07c741349a7d4d3a7ab040bd4eb306a266ba1f17ce48a8c004682e49fbc1aea0500a93f22e19e1e500b1e202e2a99ec46d4d74

  • SSDEEP

    24576:jYpTWxGrMKFRVWWsEf7YpTWxGrMKFRVWWsEf:OZFjVvWZFjVv

Score
10/10
umbralstealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1246442211583721583/3YpYr6AH1dCtDLZ01gRLybHtJudQKA33WgcrTAmy6OQgEdbJLReBBaWEGGJ6doJ140k2

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa.exe
    "C:\Users\Admin\AppData\Local\Temp\aa.exe"
    1⤵
      PID:4044

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4044-0-0x00007FFC4B003000-0x00007FFC4B005000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4044-1-0x00000000006F0000-0x000000000085C000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/4044-2-0x0000000001110000-0x0000000001158000-memory.dmp

      Filesize

      288KB

      Download