umbral

General

Target

https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGhTdHNhbVFfaWpWbG9jcWhzRVZTLU12MWM0QXxBQ3Jtc0tteFo2ekR5NFpwcVNlSzR6djR2dG9neGJubkdtU1lRZzRpajZ0eDBfREF1Ymt0MmFsd1JwcUM2TlhWUlc5UndLZ2pabTVHa2tCRzRTeHpjQzVGQkViYVdTMjQ2Nkk3Q0d3SFRTLVAwaDFVcGRicWlBYw&q=https%3A%2F%2Fdrive.google.com%2Ffile%2Fd%2F1ejmrB0CjyRUyAo46MJfZzz2ibuuOqlRA%2Fview%3Fusp%3Dsharing
Sample

240716-qrwgvavdqk

Score

10^/10

Malware Config

Targets

- Target
  
  https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGhTdHNhbVFfaWpWbG9jcWhzRVZTLU12MWM0QXxBQ3Jtc0tteFo2ekR5NFpwcVNlSzR6djR2dG9neGJubkdtU1lRZzRpajZ0eDBfREF1Ymt0MmFsd1JwcUM2TlhWUlc5UndLZ2pabTVHa2tCRzRTeHpjQzVGQkViYVdTMjQ2Nkk3Q0d3SFRTLVAwaDFVcGRicWlBYw&q=https%3A%2F%2Fdrive.google.com%2Ffile%2Fd%2F1ejmrB0CjyRUyAo46MJfZzz2ibuuOqlRA%2Fview%3Fusp%3Dsharing
Score

10^/10

umbral execution persistence spyware stealer
- Detect Umbral payload
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2