Resubmissions
23-06-2024 10:54
240623-mzjlgasenk 10Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win10v2004-20240508-en
General
-
Target
Launcher.exe
-
Size
494KB
-
MD5
41c0cc9f53b64c8ade5c65ff831b3255
-
SHA1
120c2f222bd53de2188462deedd0cb2fe52d574b
-
SHA256
e6cff5f372b24b858c8252b4ac04b4fe5dc3726391aefcdd880dd3d946854f82
-
SHA512
4b93075ebfd5a2dc503f38f9c5e1397a390a3f630580057431d702cb16d422e3b6c1098b79c404ad178ce3fb962f0c6a5922d8d4fe0646dcc1d52a3e846b32b3
-
SSDEEP
6144:nloZM9rIkd8g+EtXHkv/iD4uzaiLwiAw18e1mmiXv1DhAYkNRRg:loZOL+EP8uzaswwcdDhA/Nfg
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1253833123951673356/_Aooe8ml3fMH9fH1g-DSFNS_Il1heNqN3CVDm0yR8jgQfTfTlzbhLfgtC56Qb7TgXNKt
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Launcher.exe
Files
-
Launcher.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ