Analysis Overview
SHA256
72ec2b7ff3142521a6e640371dbf03125af27057f77ab08e2d50b0f7e3f97f7f
Threat Level: Known bad
The file Umbral.exe was found to be: Known bad.
Malicious Activity Summary
Umbral family
Umbral
Detect Umbral payload
Command and Scripting Interpreter: PowerShell
Reads user/profile data of web browsers
Looks up external IP address via web service
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Detects videocard installed
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-25 10:50
Signatures
Detect Umbral payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Umbral family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-25 10:50
Reported
2024-06-25 10:53
Platform
win10-20240611-en
Max time kernel
130s
Max time network
137s
Command Line
Signatures
Detect Umbral payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Umbral
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Reads user/profile data of web browsers
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" os get Caption
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" computersystem get totalphysicalmemory
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\System32\Wbem\wmic.exe
"wmic" path win32_VideoController get name
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gstatic.com | udp |
| GB | 172.217.16.227:443 | gstatic.com | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discordapp.com | udp |
| US | 162.159.135.233:443 | discordapp.com | tcp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 109.116.69.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
Files
memory/4132-0-0x00007FF93A5B3000-0x00007FF93A5B4000-memory.dmp
memory/4132-1-0x000001C2A7620000-0x000001C2A7660000-memory.dmp
memory/4132-2-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
memory/4140-7-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
memory/4140-8-0x0000021D7A750000-0x0000021D7A772000-memory.dmp
memory/4140-9-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
memory/4140-12-0x0000021D7A980000-0x0000021D7A9F6000-memory.dmp
memory/4140-13-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kncnud13.kv0.ps1
| MD5 | c4ca4238a0b923820dcc509a6f75849b |
| SHA1 | 356a192b7913b04c54574d18c28d46e6395428ab |
| SHA256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| SHA512 | 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a |
memory/4140-43-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
memory/4140-50-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
memory/4140-54-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 8592ba100a78835a6b94d5949e13dfc1 |
| SHA1 | 63e901200ab9a57c7dd4c078d7f75dcd3b357020 |
| SHA256 | fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c |
| SHA512 | 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d31dd566f82eb6935d1542e191b7ce90 |
| SHA1 | 767d66596f2887411ae79d987559250376e3d4c2 |
| SHA256 | 9e80c2f16313a7948c3ff9797c187ece300b8b0db6422a1ebc079f451368f678 |
| SHA512 | 067aac75aaa113d77447c2f5d9314d7e3bb8f1a7f7c20b9444de40942ead2477a0c647863a2578a9b449202aa6bb4a821781752d57b9d71ce801f73914b63878 |
memory/4132-85-0x000001C2A9430000-0x000001C2A9480000-memory.dmp
memory/4132-86-0x000001C2A9380000-0x000001C2A939E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | cf1a1c523de1414255f0cb9c2739b96f |
| SHA1 | 5ea1fd8da8b6ffb5f0881a9759904fb3687c2905 |
| SHA256 | 00408c83c0a9c1589704b77ecf1f196398e6015d8fc254ea90e5559cbbf9290a |
| SHA512 | 53946028a0277765386c1208082f1704c30dd69fc30b020ade82877c364d9629f5f7db92be07dfce0976a2254eee039e32b55f67a1beb57e4ec023bdbd0c951e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 8a1e59c03699269745b5643ba2081020 |
| SHA1 | 241c59b7061ecad030a55befa9d87f34f3c00b86 |
| SHA256 | 763b6400f3d37dd0dbd012d4ab2c32711c1343ac4a63be5699047e6a4e8663ba |
| SHA512 | 8fe90a94599415ae26a3028e13369961718334823081ff6153a583e10d3bdf209968c0bb330eca66cf0d83f714a6f42439754531222c8d4c619bfb6781998cec |
memory/4132-153-0x000001C2A93A0000-0x000001C2A93AA000-memory.dmp
memory/4132-154-0x000001C2A93E0000-0x000001C2A93F2000-memory.dmp
memory/4132-158-0x00007FF93A5B3000-0x00007FF93A5B4000-memory.dmp
memory/4132-159-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 7e3987bb730613f999959ccae4502402 |
| SHA1 | 0e7c89af7f448d033030c3de3ec233ca397784d0 |
| SHA256 | f43204724bda59a239a4d565f855956f320d61180090ca3b7976d0d8883cd90f |
| SHA512 | d9e1a96b66692ee66e47b5a5c2d4d3f408aee2a260c05dc7589e6099c7dd03816ac843d88e203b2dde8b65422f05a1676e5c5bf5c8c18ae1b659ab6d8fd5e5f3 |
memory/4132-188-0x00007FF93A5B0000-0x00007FF93AF9C000-memory.dmp