umbral | e669f3bc914d22c2e24dd7f7af3a0008cc7b836dbee529c69760b56cd38032e7

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.rar
Size

82KB
MD5

f2768da94a45433f5b9cd380d1ee9701
SHA1

4f9f8ab92e49895253c4cdadcb2895271a3515fb
SHA256

e669f3bc914d22c2e24dd7f7af3a0008cc7b836dbee529c69760b56cd38032e7
SHA512

1d13e10f1b4862f97443aeb92a4d716d09894b481b5bbdd2de661428877ee4a5f48a3d1615c27b06d8c2529754c883ee7fc20ba150d2e8ce1a3a0a3685b23f09
SSDEEP

1536:Cg5Du81UykuZZfNMjO6lWbbTsUAXuHvMPQtTN97XE5kCE8VZzz6N/:TDunOgjPYz97XqrPVZz8

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000e00000001269e-29.dat	family_umbral
behavioral1/memory/2760-32-0x00000000013C0000-0x0000000001400000-memory.dmp	family_umbral
behavioral1/memory/1944-35-0x00000000000F0000-0x0000000000130000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Executes dropped EXE 2 IoCs

pid	Process
2760	WaveInstaller.exe
1944	WaveInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2652	7zFM.exe
Token: 35	2652	7zFM.exe
Token: SeSecurityPrivilege	2652	7zFM.exe
Token: SeSecurityPrivilege	2652	7zFM.exe
Token: SeDebugPrivilege	2760	WaveInstaller.exe
Token: SeIncreaseQuotaPrivilege	1304	wmic.exe
Token: SeSecurityPrivilege	1304	wmic.exe
Token: SeTakeOwnershipPrivilege	1304	wmic.exe
Token: SeLoadDriverPrivilege	1304	wmic.exe
Token: SeSystemProfilePrivilege	1304	wmic.exe
Token: SeSystemtimePrivilege	1304	wmic.exe
Token: SeProfSingleProcessPrivilege	1304	wmic.exe
Token: SeIncBasePriorityPrivilege	1304	wmic.exe
Token: SeCreatePagefilePrivilege	1304	wmic.exe
Token: SeBackupPrivilege	1304	wmic.exe
Token: SeRestorePrivilege	1304	wmic.exe
Token: SeShutdownPrivilege	1304	wmic.exe
Token: SeDebugPrivilege	1304	wmic.exe
Token: SeSystemEnvironmentPrivilege	1304	wmic.exe
Token: SeRemoteShutdownPrivilege	1304	wmic.exe
Token: SeUndockPrivilege	1304	wmic.exe
Token: SeManageVolumePrivilege	1304	wmic.exe
Token: 33	1304	wmic.exe
Token: 34	1304	wmic.exe
Token: 35	1304	wmic.exe
Token: SeIncreaseQuotaPrivilege	1304	wmic.exe
Token: SeSecurityPrivilege	1304	wmic.exe
Token: SeTakeOwnershipPrivilege	1304	wmic.exe
Token: SeLoadDriverPrivilege	1304	wmic.exe
Token: SeSystemProfilePrivilege	1304	wmic.exe
Token: SeSystemtimePrivilege	1304	wmic.exe
Token: SeProfSingleProcessPrivilege	1304	wmic.exe
Token: SeIncBasePriorityPrivilege	1304	wmic.exe
Token: SeCreatePagefilePrivilege	1304	wmic.exe
Token: SeBackupPrivilege	1304	wmic.exe
Token: SeRestorePrivilege	1304	wmic.exe
Token: SeShutdownPrivilege	1304	wmic.exe
Token: SeDebugPrivilege	1304	wmic.exe
Token: SeSystemEnvironmentPrivilege	1304	wmic.exe
Token: SeRemoteShutdownPrivilege	1304	wmic.exe
Token: SeUndockPrivilege	1304	wmic.exe
Token: SeManageVolumePrivilege	1304	wmic.exe
Token: 33	1304	wmic.exe
Token: 34	1304	wmic.exe
Token: 35	1304	wmic.exe
Token: SeDebugPrivilege	1944	WaveInstaller.exe
Token: SeIncreaseQuotaPrivilege	688	wmic.exe
Token: SeSecurityPrivilege	688	wmic.exe
Token: SeTakeOwnershipPrivilege	688	wmic.exe
Token: SeLoadDriverPrivilege	688	wmic.exe
Token: SeSystemProfilePrivilege	688	wmic.exe
Token: SeSystemtimePrivilege	688	wmic.exe
Token: SeProfSingleProcessPrivilege	688	wmic.exe
Token: SeIncBasePriorityPrivilege	688	wmic.exe
Token: SeCreatePagefilePrivilege	688	wmic.exe
Token: SeBackupPrivilege	688	wmic.exe
Token: SeRestorePrivilege	688	wmic.exe
Token: SeShutdownPrivilege	688	wmic.exe
Token: SeDebugPrivilege	688	wmic.exe
Token: SeSystemEnvironmentPrivilege	688	wmic.exe
Token: SeRemoteShutdownPrivilege	688	wmic.exe
Token: SeUndockPrivilege	688	wmic.exe
Token: SeManageVolumePrivilege	688	wmic.exe
Token: 33	688	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2652	7zFM.exe
2652	7zFM.exe
2652	7zFM.exe
2652	7zFM.exe
2652	7zFM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2652	2524	cmd.exe	29
PID 2524 wrote to memory of 2652	2524	cmd.exe	29
PID 2524 wrote to memory of 2652	2524	cmd.exe	29
PID 2760 wrote to memory of 1304	2760	WaveInstaller.exe	38
PID 2760 wrote to memory of 1304	2760	WaveInstaller.exe	38
PID 2760 wrote to memory of 1304	2760	WaveInstaller.exe	38
PID 1944 wrote to memory of 688	1944	WaveInstaller.exe	42
PID 1944 wrote to memory of 688	1944	WaveInstaller.exe	42
PID 1944 wrote to memory of 688	1944	WaveInstaller.exe	42

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WaveInstaller.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2652

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2468

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1304

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe

Filesize
231KB

MD5
0eca651a9a275b0674a052b757f4b9ae

SHA1
d646b68d18a28ba263ea2930e58f0b30ac83b4a3

SHA256
64f6576c6db1eaaefbe0ab36e362592c8b27ff856cfcb29c032d06c1f289df1c

SHA512
d1f62b20625a982c3b59fdc56af47833b5f3e0ed2bb3aa03b1c8b71c3160999d87bc53f9f4f7bf1cdf6d45d87ff6e5c96a5cc0977c0da9b6ec1278b3c24870d5

Download Submit
memory/1944-35-0x00000000000F0000-0x0000000000130000-memory.dmp

Filesize
256KB

Download
memory/2760-32-0x00000000013C0000-0x0000000001400000-memory.dmp

Filesize
256KB

Download