umbral | 529446272a00573d797941f1e6536647be16499be376133ac65899c97305903e

Analysis

max time kernel
4s
max time network
7s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CsGo 2 Cheat/undetek-v6.9.3.exe
Size

230KB
MD5

516758abff2f243a0cba24669f96c751
SHA1

6a7dd5a986c4b213cb624212137b9132f0c4ef21
SHA256

47c501095d9096a3c2837d2312f3c51b679964e2c40426e5f9a245b7b5b66939
SHA512

7b254602e70075f02b3d19a2a8f669d4a8f5a0c1b5278fd2b4e154b3668d1cfea00da80984395a80da62c232e1b69320725992a14183642a579fb0b98c147162
SSDEEP

6144:TloZM+rIkd8g+EtXHkv/iD4lvuPT5KyNv4ZL22jOjb8e1mYi:RoZtL+EP8lvuPT5KyNv4ZL22jg2

Score

10^/10

umbral execution stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/296-1-0x0000000000A90000-0x0000000000AD0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2732	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
296	undetek-v6.9.3.exe
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	296	undetek-v6.9.3.exe
Token: SeIncreaseQuotaPrivilege	2376	wmic.exe
Token: SeSecurityPrivilege	2376	wmic.exe
Token: SeTakeOwnershipPrivilege	2376	wmic.exe
Token: SeLoadDriverPrivilege	2376	wmic.exe
Token: SeSystemProfilePrivilege	2376	wmic.exe
Token: SeSystemtimePrivilege	2376	wmic.exe
Token: SeProfSingleProcessPrivilege	2376	wmic.exe
Token: SeIncBasePriorityPrivilege	2376	wmic.exe
Token: SeCreatePagefilePrivilege	2376	wmic.exe
Token: SeBackupPrivilege	2376	wmic.exe
Token: SeRestorePrivilege	2376	wmic.exe
Token: SeShutdownPrivilege	2376	wmic.exe
Token: SeDebugPrivilege	2376	wmic.exe
Token: SeSystemEnvironmentPrivilege	2376	wmic.exe
Token: SeRemoteShutdownPrivilege	2376	wmic.exe
Token: SeUndockPrivilege	2376	wmic.exe
Token: SeManageVolumePrivilege	2376	wmic.exe
Token: 33	2376	wmic.exe
Token: 34	2376	wmic.exe
Token: 35	2376	wmic.exe
Token: SeIncreaseQuotaPrivilege	2376	wmic.exe
Token: SeSecurityPrivilege	2376	wmic.exe
Token: SeTakeOwnershipPrivilege	2376	wmic.exe
Token: SeLoadDriverPrivilege	2376	wmic.exe
Token: SeSystemProfilePrivilege	2376	wmic.exe
Token: SeSystemtimePrivilege	2376	wmic.exe
Token: SeProfSingleProcessPrivilege	2376	wmic.exe
Token: SeIncBasePriorityPrivilege	2376	wmic.exe
Token: SeCreatePagefilePrivilege	2376	wmic.exe
Token: SeBackupPrivilege	2376	wmic.exe
Token: SeRestorePrivilege	2376	wmic.exe
Token: SeShutdownPrivilege	2376	wmic.exe
Token: SeDebugPrivilege	2376	wmic.exe
Token: SeSystemEnvironmentPrivilege	2376	wmic.exe
Token: SeRemoteShutdownPrivilege	2376	wmic.exe
Token: SeUndockPrivilege	2376	wmic.exe
Token: SeManageVolumePrivilege	2376	wmic.exe
Token: 33	2376	wmic.exe
Token: 34	2376	wmic.exe
Token: 35	2376	wmic.exe
Token: SeDebugPrivilege	2732	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 296 wrote to memory of 2376	296	undetek-v6.9.3.exe	28
PID 296 wrote to memory of 2376	296	undetek-v6.9.3.exe	28
PID 296 wrote to memory of 2376	296	undetek-v6.9.3.exe	28
PID 296 wrote to memory of 2656	296	undetek-v6.9.3.exe	31
PID 296 wrote to memory of 2656	296	undetek-v6.9.3.exe	31
PID 296 wrote to memory of 2656	296	undetek-v6.9.3.exe	31
PID 296 wrote to memory of 2732	296	undetek-v6.9.3.exe	33
PID 296 wrote to memory of 2732	296	undetek-v6.9.3.exe	33
PID 296 wrote to memory of 2732	296	undetek-v6.9.3.exe	33
PID 296 wrote to memory of 2788	296	undetek-v6.9.3.exe	35
PID 296 wrote to memory of 2788	296	undetek-v6.9.3.exe	35
PID 296 wrote to memory of 2788	296	undetek-v6.9.3.exe	35

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2656	attrib.exe

C:\Users\Admin\AppData\Local\Temp\CsGo 2 Cheat\undetek-v6.9.3.exe
"C:\Users\Admin\AppData\Local\Temp\CsGo 2 Cheat\undetek-v6.9.3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\system32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\CsGo 2 Cheat\undetek-v6.9.3.exe"
  2⤵
  - Views/modifies file attributes
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CsGo 2 Cheat\undetek-v6.9.3.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2O6LYYE689MMN4X6QFS6.temp

Filesize
7KB

MD5
647943e3010b9003bdf98d50de18c3a6

SHA1
f57f89f9580a6ce28572e82e53b83845353e7f0d

SHA256
0454546932019ccc35320aefac5db75ae9d2a887e2749752c3d3cc97bd87f06e

SHA512
f3657de2717b256abbf06efe1b7e1b04b8e32eabc8a94c8cca7fe9ec48810857b3067417424013d444ca19b63d598e46ea2bc70f75ff2f0bb91eeb73d9235f5c

Download Submit
memory/296-0-0x000007FEF5723000-0x000007FEF5724000-memory.dmp

Filesize
4KB

Download
memory/296-1-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/296-2-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download
memory/2732-7-0x000000001B2B0000-0x000000001B592000-memory.dmp

Filesize
2.9MB

Download
memory/2732-8-0x00000000024A0000-0x00000000024A8000-memory.dmp

Filesize
32KB

Download
memory/2788-14-0x000000001B2A0000-0x000000001B582000-memory.dmp

Filesize
2.9MB

Download
memory/2788-15-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download