umbral | Saransk[.]exe | Triage

Sharing

General

Target

Saransk.exe
Size

231KB
MD5

acca3f3236c113ab4c20d8697eeaeaca
SHA1

c921b69ba68786a49ed6c7ec92dac8f42700275c
SHA256

75f18abe6b6d94ca03e91c6eddbfaee49827e731ba78e62f4f47e890fb9dbe53
SHA512

787a595f745f26dcb569fe1f3beb0b90206d6bcc7e4d8a62b7e3fabf4f2435410621aec5d2b4327d357b2d3f240430974b592e23d0a247e9a082659ff6bdf39c
SSDEEP

6144:xloZM+rIkd8g+EtXHkv/iD4Ycpc4+ZRS63q459c2tb8e1mYoi:DoZtL+EP8Ycpc4+ZRS63q459cu/R

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1252168499489407067/Q1e6m53iIsS9AsIAU1dJzTmBY6KFX7wQjA-70SAwLfA3STehGFJ_2t0YbeTIwurNb8Gl

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource yara_rule

sample family_umbral
Umbral family
umbral
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Saransk.exe

Files

Saransk.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ