Overview

overview

10

Static

static

10

TEST.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TEST.rar

  • Size

    80KB

  • Sample

    240607-x412esdc96

  • MD5

    b73a235392b360b22f6b244b0b0af97a

  • SHA1

    524829a16a97ba862337b8ad7ec86707e231cfe9

  • SHA256

    c2caa0fa4a868c131c9139635dd57f67ec1bba9283ab4b0a121fdff5a4a21082

  • SHA512

    50122d08a5965c537ab7bf9bc8c5372ae48858459e47a652e04d98a3dc8c02f5664f759600e07b658de543696c0c06dbf0311d583168ae43427f67c057801c64

  • SSDEEP

    1536:5PJo3xi6Dpg60TuRW3mF50HuCvsfqSYh35wHGIDO8sGAYNQ7OPqyMHC96:5C3s6DpF0Kg3mFWdcqhwHGUO0qIn96

Score
10/10
umbralexecutionspywarestealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1248680916088524882/scOLRb8Ed3pZrVLq-wxEU3RMvJbAjEVyHOhqKEPHD6NL1h3WeGeXo53UPUp5psuRr4DL

Targets

    • Target

      TEST.exe

    • Size

      229KB

    • MD5

      9dc985d83754309760ae45747d8081c2

    • SHA1

      b60e1c39ee8da20c5bdf1df501fab12fd45eaf50

    • SHA256

      f3fdf0137c30af49a71a174e204795a0b96ef2a8a0a53fda4add34574f79005b

    • SHA512

      d0908c5e493bd83cd58e73b715c9318cb6032bb388d7c6ffbdc75b4bb813e594153a57e2ecebbe0a2d1aa0513312be16886b08ad8b91fc590217838057a730cf

    • SSDEEP

      6144:tloZM+rIkd8g+EtXHkv/iD4hYBSGELnsmd42X3WVzb8e1mzi:voZtL+EP8hYBSGELnsmd42X3WtB

    Score
    10/10
    umbralexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks