Malware Analysis Report

2024-10-10 09:53

Sample ID 240703-r94rlstgpb
Target Umbral.exe
SHA256 7faa7dc741f6cbee158e99306c59f254e878236501f8cca5d6c29ed2c2029f2a
Tags
umbral stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7faa7dc741f6cbee158e99306c59f254e878236501f8cca5d6c29ed2c2029f2a

Threat Level: Known bad

The file Umbral.exe was found to be: Known bad.

Malicious Activity Summary

umbral stealer

Detect Umbral payload

Umbral family

Umbral

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-03 14:54

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral family

umbral

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 14:54

Reported

2024-07-03 14:54

Platform

win10v2004-20240508-en

Max time kernel

7s

Max time network

6s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral

stealer umbral

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp

Files

memory/1276-0-0x000002020AF40000-0x000002020AF80000-memory.dmp

memory/1276-1-0x00007FFDCF893000-0x00007FFDCF895000-memory.dmp

memory/1276-2-0x00007FFDCF890000-0x00007FFDD0351000-memory.dmp

memory/2584-3-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-5-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-4-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-15-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-14-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-13-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-12-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-11-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-10-0x000001B1BF260000-0x000001B1BF261000-memory.dmp

memory/2584-9-0x000001B1BF260000-0x000001B1BF261000-memory.dmp