umbral | 0091be76fcfaadfb4d45f22ce3cb5189fd919ee89cfb901c9eed7f6a6aa61c6a | Triage

Sharing

General

Target

BALDI.exe
Size

5.6MB
Sample

240625-gx397sthkd
MD5

8235f398b63cb2b0926edf528a56ad35
SHA1

668ff71112d6bf289b70659d063d524481c19b0f
SHA256

0091be76fcfaadfb4d45f22ce3cb5189fd919ee89cfb901c9eed7f6a6aa61c6a
SHA512

51cf7794ea120ebaad6d53b2722f35e57b1d28b5365e53a74d945f45d180d6a5bfe3b27f963485c53079103947e552c88631485ba49a160a4b09c9afd4a66674
SSDEEP

98304:3rd/2Kf8MIhWIcn1111DIgzO9QeMfXTjig8nuluLlKUORY+6Mrv:3rR2KfBIc1j1J8sfXvpQlHfE

Score

10^/10

umbral discovery evasion execution exploit persistence privilege_escalation ransomware stealer trojan

Malware Config

Targets

- Target
  
  BALDI.exe
- Size
  
  5.6MB
- MD5
  
  8235f398b63cb2b0926edf528a56ad35
- SHA1
  
  668ff71112d6bf289b70659d063d524481c19b0f
- SHA256
  
  0091be76fcfaadfb4d45f22ce3cb5189fd919ee89cfb901c9eed7f6a6aa61c6a
- SHA512
  
  51cf7794ea120ebaad6d53b2722f35e57b1d28b5365e53a74d945f45d180d6a5bfe3b27f963485c53079103947e552c88631485ba49a160a4b09c9afd4a66674
- SSDEEP
  
  98304:3rd/2Kf8MIhWIcn1111DIgzO9QeMfXTjig8nuluLlKUORY+6Mrv:3rR2KfBIc1j1J8sfXvpQlHfE
Score

10^/10

umbral discovery evasion execution exploit persistence privilege_escalation ransomware stealer trojan
- Detect Umbral payload
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Accessibility Features

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Accessibility Features

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

behavioral2

umbraldiscoveryevasionexecutionexploitpersistenceprivilege_escalationransomwarestealertrojan