umbral | ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe
Size 6.5MB
Sample240611-cagepszckd
SHA256 ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf
MD5 332ba662e3c3f073ae86fee29789571d
SHA1 5901a5ef0817d5e56f54b4d2a4385717a1b21975
SHA512 8a00f9595aa18ec77b268a4b3d37888ddb45fd567a09597f5bd369f767f7a5003784606ecc92943a1f8b02d2ae9afa8cc9b99e40d8f03f9aaef2c511cac4845b
SSDEEP 196608:o4hV+n8bqD6SiCwDYHLiOYf6OQlmfVuwcP/OCw3P:o4Xc8bqD6SDkhamfVuwcP/jQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral pyinstaller stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	family_umbral
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Detects executables attemping to enumerate video devices using WMI 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing possible sandbox analysis VM names 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables containing possible sandbox system UUIDs 2 IoCs

resource	yara_rule
behavioral2/files/0x0012000000016964-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs
behavioral2/memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe

Executes dropped EXE 3 IoCs

pid	Process
4892	Umbral.exe
2684	cracked_lunar.exe
1552	cracked_lunar.exe

Loads dropped DLL 2 IoCs

pid	Process
1552	cracked_lunar.exe
1552	cracked_lunar.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0005000000022abf-19.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	Umbral.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4892	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	85
PID 4016 wrote to memory of 4892	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	85
PID 4016 wrote to memory of 2684	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	86
PID 4016 wrote to memory of 2684	4016	ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe	86
PID 2684 wrote to memory of 1552	2684	cracked_lunar.exe	88
PID 2684 wrote to memory of 1552	2684	cracked_lunar.exe	88

C:\Users\Admin\AppData\Local\Temp\ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe
"C:\Users\Admin\AppData\Local\Temp\ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
    "C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Umbral.exe

Path C:\Users\Admin\AppData\Local\Temp\Umbral.exe
Size 231KB
SHA256 33224838e69caedeab2c5d062cc2c9361183b09a41a43aa867e0707f2f9651dc
MD5 05ae0d8ad164e11750e3552344e1ff01
SHA1 41b27283ba72e1651ac5065fe56187a2706eb069
SHA512 b33307d09333901236c919cba683df3d57baf2b9460ca757f8134dabeb730109d9e303a6d51caf21d0844b40192e5929b4a3d04a60f526ffac18fb290a0a7ffb
SSDEEP 6144:RloZMmrIkd8g+EtXHkv/iD4JEW4hv0IHh2PxM4d7hb8e1mPv4i:joZ1L+EP8JEW4hv0IHh2PxM4dly5
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26842\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI26842\base_library.zip
Size 1.7MB
SHA256 9e830533f6e67b84d9dbc502db38a6f25d3c984f1a6a195a50f838d48d5b3ba5
MD5 334e5d6e591eccd91d2121194db22815
SHA1 821d70c44dc7f25a784e9938d74e75a3471e1ad0
SHA512 bac4a1283745e5eb4db953227bbf00831c8a0c3c831f5889e0d0630841e59c8ad96c3386ce3ad48300f4754fde188212edc79b78c9c98f76bca21987c1c05866
SSDEEP 24576:6QRqL5TPAxNWlUKdcubgAnj90W0AWfhWrpdYMbP/MdGTKdm64jdfw:6QRqL2xNieTZ46/
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26842\python311.dll
Size 5.5MB
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
SSDEEP 98304:JdHwQkq3AAtsPv3XXTVEspHBMp4SsPxQpe2bx:JdHwQkq3AMsPvHXSpAxQpe2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

cracked_lunar.exe

Path C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
Size 6.7MB
SHA256 524753508a50c33f404a87441625e1d9967d0c1a11b31c534e2d60b838fb1589
MD5 a935a661746292c72c43f96a685fb148
SHA1 464e4e832670ced5441b507a85fe79a4bdeb4802
SHA512 68e9a17255eab3ad2ae27442d1921a084c882ec59b6a498fbf3e8ab3e6b06b8c78a9e33871051b5bf9e5c974cf5b381433b1fdfd3b4ba2369ca91269de52bcf3
SSDEEP 196608:Bfv8S5dQmRrdA6ly8Qnf2ODjMnGydS8GSyrDOQWl3:1l5dQOl6F3MnG38GSyrDPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4016-10-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Download

memory/4016-25-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Download

memory/4016-0-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp

Download

memory/4016-1-0x0000000000DA0000-0x0000000001432000-memory.dmp

Download

memory/4892-20-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Download

memory/4892-24-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Download

memory/4892-14-0x0000019DD3E10000-0x0000019DD3E50000-memory.dmp

Download

memory/4892-46-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads