Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 09:30
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
e91e7d0ed8c652cc6d31b843ce779610
-
SHA1
30100ace6bde410478ab46fd06ffb28759fbbd78
-
SHA256
de9370ce0b17b04fa1deb6403251580f6cf32035659da7ed57756c08c690d666
-
SHA512
9ccda4488fc512344ce51b6173da48902058df858ff82edbe906ef7c116800074823fc179f69ad687d4196d21bf4683ca5dc4a142f69a127714ae3dc37aa1130
-
SSDEEP
6144:lloZM9rIkd8g+EtXHkv/iD4UZ7coOJBi0HaIJtMByb8e1mF56Yi:noZOL+EP8UZ7coOJBi0HaIJtMgs50
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/644-1-0x000001B6528E0000-0x000001B652920000-memory.dmp family_umbral -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1812 powershell.exe 2828 powershell.exe 1856 powershell.exe 3108 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 62 discord.com 63 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 59 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4548 cmd.exe 2344 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 812 wmic.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2344 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3536 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 644 Umbral.exe Token: SeDebugPrivilege 3536 taskmgr.exe Token: SeSystemProfilePrivilege 3536 taskmgr.exe Token: SeCreateGlobalPrivilege 3536 taskmgr.exe Token: SeDebugPrivilege 1812 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 468 powershell.exe Token: SeIncreaseQuotaPrivilege 1308 wmic.exe Token: SeSecurityPrivilege 1308 wmic.exe Token: SeTakeOwnershipPrivilege 1308 wmic.exe Token: SeLoadDriverPrivilege 1308 wmic.exe Token: SeSystemProfilePrivilege 1308 wmic.exe Token: SeSystemtimePrivilege 1308 wmic.exe Token: SeProfSingleProcessPrivilege 1308 wmic.exe Token: SeIncBasePriorityPrivilege 1308 wmic.exe Token: SeCreatePagefilePrivilege 1308 wmic.exe Token: SeBackupPrivilege 1308 wmic.exe Token: SeRestorePrivilege 1308 wmic.exe Token: SeShutdownPrivilege 1308 wmic.exe Token: SeDebugPrivilege 1308 wmic.exe Token: SeSystemEnvironmentPrivilege 1308 wmic.exe Token: SeRemoteShutdownPrivilege 1308 wmic.exe Token: SeUndockPrivilege 1308 wmic.exe Token: SeManageVolumePrivilege 1308 wmic.exe Token: 33 1308 wmic.exe Token: 34 1308 wmic.exe Token: 35 1308 wmic.exe Token: 36 1308 wmic.exe Token: SeIncreaseQuotaPrivilege 1308 wmic.exe Token: SeSecurityPrivilege 1308 wmic.exe Token: SeTakeOwnershipPrivilege 1308 wmic.exe Token: SeLoadDriverPrivilege 1308 wmic.exe Token: SeSystemProfilePrivilege 1308 wmic.exe Token: SeSystemtimePrivilege 1308 wmic.exe Token: SeProfSingleProcessPrivilege 1308 wmic.exe Token: SeIncBasePriorityPrivilege 1308 wmic.exe Token: SeCreatePagefilePrivilege 1308 wmic.exe Token: SeBackupPrivilege 1308 wmic.exe Token: SeRestorePrivilege 1308 wmic.exe Token: SeShutdownPrivilege 1308 wmic.exe Token: SeDebugPrivilege 1308 wmic.exe Token: SeSystemEnvironmentPrivilege 1308 wmic.exe Token: SeRemoteShutdownPrivilege 1308 wmic.exe Token: SeUndockPrivilege 1308 wmic.exe Token: SeManageVolumePrivilege 1308 wmic.exe Token: 33 1308 wmic.exe Token: 34 1308 wmic.exe Token: 35 1308 wmic.exe Token: 36 1308 wmic.exe Token: SeIncreaseQuotaPrivilege 2472 wmic.exe Token: SeSecurityPrivilege 2472 wmic.exe Token: SeTakeOwnershipPrivilege 2472 wmic.exe Token: SeLoadDriverPrivilege 2472 wmic.exe Token: SeSystemProfilePrivilege 2472 wmic.exe Token: SeSystemtimePrivilege 2472 wmic.exe Token: SeProfSingleProcessPrivilege 2472 wmic.exe Token: SeIncBasePriorityPrivilege 2472 wmic.exe Token: SeCreatePagefilePrivilege 2472 wmic.exe Token: SeBackupPrivilege 2472 wmic.exe Token: SeRestorePrivilege 2472 wmic.exe Token: SeShutdownPrivilege 2472 wmic.exe Token: SeDebugPrivilege 2472 wmic.exe Token: SeSystemEnvironmentPrivilege 2472 wmic.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 644 wrote to memory of 2012 644 Umbral.exe 103 PID 644 wrote to memory of 2012 644 Umbral.exe 103 PID 644 wrote to memory of 1812 644 Umbral.exe 105 PID 644 wrote to memory of 1812 644 Umbral.exe 105 PID 644 wrote to memory of 2828 644 Umbral.exe 107 PID 644 wrote to memory of 2828 644 Umbral.exe 107 PID 644 wrote to memory of 1856 644 Umbral.exe 109 PID 644 wrote to memory of 1856 644 Umbral.exe 109 PID 644 wrote to memory of 468 644 Umbral.exe 111 PID 644 wrote to memory of 468 644 Umbral.exe 111 PID 644 wrote to memory of 1308 644 Umbral.exe 114 PID 644 wrote to memory of 1308 644 Umbral.exe 114 PID 644 wrote to memory of 2472 644 Umbral.exe 116 PID 644 wrote to memory of 2472 644 Umbral.exe 116 PID 644 wrote to memory of 4928 644 Umbral.exe 118 PID 644 wrote to memory of 4928 644 Umbral.exe 118 PID 644 wrote to memory of 3108 644 Umbral.exe 120 PID 644 wrote to memory of 3108 644 Umbral.exe 120 PID 644 wrote to memory of 812 644 Umbral.exe 122 PID 644 wrote to memory of 812 644 Umbral.exe 122 PID 644 wrote to memory of 4548 644 Umbral.exe 124 PID 644 wrote to memory of 4548 644 Umbral.exe 124 PID 4548 wrote to memory of 2344 4548 cmd.exe 126 PID 4548 wrote to memory of 2344 4548 cmd.exe 126 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2012 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Views/modifies file attributes
PID:2012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:4928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
PID:3108
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:812
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2344
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3536
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1856
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
948B
MD50e046a2ca47c01116ab2c42b4553232c
SHA1750650547f305d5cd7f832341f6a17618aa98800
SHA256d063753bbc9924e4bf9306167893909c3898072109e13b479ccdac493a8f3a2d
SHA512dc1c95dbb27fb1fcc577a841abad5a2ca16445b1c51640853f497df8fca260ae5d5fee2d402b18c61a263a6af5a5b71661fb880234bd8de3e6636887f03ae0df
-
Filesize
1KB
MD545fb9d7dd2918093a914fef36f5eeb21
SHA162ada2131906247f7c8c0862f4fcd9750d1334de
SHA256aea229b88071a17a2ac0ea96bdc4e6a632ddb9e5dabf09541117390f1c191869
SHA5122dca3ed9b281b5e97b86d1a7e939986910723a147afe3906b7ca1a224b83a22a378fc10742db96947e7e797ad7244d78985e938ad5eba711989943ba913bd2de
-
Filesize
1KB
MD5cb5c30d213a938d76ea627a4d05a0111
SHA19618958b449d646cb833edefb01dd372f8f0f4b0
SHA256387991a291e69339f9a6099b4e9c55e55e5c6409e2c8ec50aa7ddbe3025a39dc
SHA51254ff985ae7f14cc1a3c02d502be4c57ffbc231394e6358c37a0b00513d660ac52198bd946b1972491df54870e8414f905f7d398f0787ee1fe6652e194c801f07
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82