Behavioral task
behavioral1
Sample
WaveInstaller.exe
Resource
win7-20240221-en
General
-
Target
WaveInstaller.exe
-
Size
229KB
-
MD5
7ca49c1e4deac51030961240dc071e44
-
SHA1
dbe976f4e1ca8476cf35105e214e98c071bdb601
-
SHA256
c4969a3f443dc0c21066c9b801a86d8802585ed708f209cd418d0252541884bd
-
SHA512
cb70825c4cebc592cfe281214f3a614a5a0eac78dac3cc0a5da7116b9d2eb5af718745067c0c7be3b2957c3ddade18416171863490d40c0bec8162e0322303ae
-
SSDEEP
6144:FloZMZrIkd8g+EtXHkv/iD4SpQvDJ6id1IJbGmTuOb8e1mBi:HoZ6L+EP8SpQvDJ6id1IJbGmT5D
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1257990750105239572/oxObyEqK8LZqJLF9958xM8O0ELZTwn2jyxVKBszQf6OpxSVsjZjE1JOm2PnReGiCbZkI
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WaveInstaller.exe
Files
-
WaveInstaller.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ