umbral | ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf

General

Target

ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe
Size

6.5MB
MD5

332ba662e3c3f073ae86fee29789571d
SHA1

5901a5ef0817d5e56f54b4d2a4385717a1b21975
SHA256

ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf
SHA512

8a00f9595aa18ec77b268a4b3d37888ddb45fd567a09597f5bd369f767f7a5003784606ecc92943a1f8b02d2ae9afa8cc9b99e40d8f03f9aaef2c511cac4845b
SSDEEP

196608:o4hV+n8bqD6SiCwDYHLiOYf6OQlmfVuwcP/OCw3P:o4Xc8bqD6SDkhamfVuwcP/jQ

Score

10^/10

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	family_umbral
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Detects executables attemping to enumerate video devices using WMI 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing possible sandbox analysis VM names 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables containing possible sandbox system UUIDs 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe

Executes dropped EXE 3 IoCs

pid	Process
4892	Umbral.exe
2684	cracked_lunar.exe
1552	cracked_lunar.exe

Loads dropped DLL 2 IoCs

pid	Process
1552	cracked_lunar.exe
1552	cracked_lunar.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0005000000022abf-19.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	Umbral.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4892	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	85
PID 4016 wrote to memory of 4892	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	85
PID 4016 wrote to memory of 2684	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	86
PID 4016 wrote to memory of 2684	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	86
PID 2684 wrote to memory of 1552	2684	cracked_lunar.exe	88
PID 2684 wrote to memory of 1552	2684	cracked_lunar.exe	88

C:\Users\Admin\AppData\Local\Temp\ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe
"C:\Users\Admin\AppData\Local\Temp\ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
    "C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
231KB

MD5
05ae0d8ad164e11750e3552344e1ff01

SHA1
41b27283ba72e1651ac5065fe56187a2706eb069

SHA256
33224838e69caedeab2c5d062cc2c9361183b09a41a43aa867e0707f2f9651dc

SHA512
b33307d09333901236c919cba683df3d57baf2b9460ca757f8134dabeb730109d9e303a6d51caf21d0844b40192e5929b4a3d04a60f526ffac18fb290a0a7ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26842\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26842\base_library.zip

Filesize
1.7MB

MD5
334e5d6e591eccd91d2121194db22815

SHA1
821d70c44dc7f25a784e9938d74e75a3471e1ad0

SHA256
9e830533f6e67b84d9dbc502db38a6f25d3c984f1a6a195a50f838d48d5b3ba5

SHA512
bac4a1283745e5eb4db953227bbf00831c8a0c3c831f5889e0d0630841e59c8ad96c3386ce3ad48300f4754fde188212edc79b78c9c98f76bca21987c1c05866

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26842\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe

Filesize
6.7MB

MD5
a935a661746292c72c43f96a685fb148

SHA1
464e4e832670ced5441b507a85fe79a4bdeb4802

SHA256
524753508a50c33f404a87441625e1d9967d0c1a11b31c534e2d60b838fb1589

SHA512
68e9a17255eab3ad2ae27442d1921a084c882ec59b6a498fbf3e8ab3e6b06b8c78a9e33871051b5bf9e5c974cf5b381433b1fdfd3b4ba2369ca91269de52bcf3

Download Submit
memory/4016-10-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/4016-25-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/4016-0-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp

Filesize
8KB

Download
memory/4016-1-0x0000000000DA0000-0x0000000001432000-memory.dmp

Filesize
6.6MB

Download
memory/4892-20-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/4892-24-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp

Filesize
256KB

Download
memory/4892-46-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing