Resubmissions
26-07-2024 22:22
240726-2ap5aaycqq 10Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-07-2024 22:22
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
Umbral.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
7b8f7224e44d39c521160c3b33e22e98
-
SHA1
a8ab775e550aef4aa3b2f485116bcc245c7ccb48
-
SHA256
256aa419764dc6cf6fef1a4bbe7a918c207c48515e9e13d18881a69b326c79f0
-
SHA512
c11c922edb6d3aa634fd68dc59a86463fd29b27eead95864efc003fcbb226610854f3acceff7b580fb96443952aa68696f87ea4004e01af96eca570a75359859
-
SSDEEP
6144:tloZM9rIkd8g+EtXHkv/iD4u5PpSQPL42BECDja/yb8e1mUZJi:voZmL+EP8u5PpSQPL42BECDjamp+
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2192-1-0x00000204E63E0000-0x00000204E6420000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2192 Umbral.exe Token: SeIncreaseQuotaPrivilege 3000 wmic.exe Token: SeSecurityPrivilege 3000 wmic.exe Token: SeTakeOwnershipPrivilege 3000 wmic.exe Token: SeLoadDriverPrivilege 3000 wmic.exe Token: SeSystemProfilePrivilege 3000 wmic.exe Token: SeSystemtimePrivilege 3000 wmic.exe Token: SeProfSingleProcessPrivilege 3000 wmic.exe Token: SeIncBasePriorityPrivilege 3000 wmic.exe Token: SeCreatePagefilePrivilege 3000 wmic.exe Token: SeBackupPrivilege 3000 wmic.exe Token: SeRestorePrivilege 3000 wmic.exe Token: SeShutdownPrivilege 3000 wmic.exe Token: SeDebugPrivilege 3000 wmic.exe Token: SeSystemEnvironmentPrivilege 3000 wmic.exe Token: SeRemoteShutdownPrivilege 3000 wmic.exe Token: SeUndockPrivilege 3000 wmic.exe Token: SeManageVolumePrivilege 3000 wmic.exe Token: 33 3000 wmic.exe Token: 34 3000 wmic.exe Token: 35 3000 wmic.exe Token: 36 3000 wmic.exe Token: SeIncreaseQuotaPrivilege 3000 wmic.exe Token: SeSecurityPrivilege 3000 wmic.exe Token: SeTakeOwnershipPrivilege 3000 wmic.exe Token: SeLoadDriverPrivilege 3000 wmic.exe Token: SeSystemProfilePrivilege 3000 wmic.exe Token: SeSystemtimePrivilege 3000 wmic.exe Token: SeProfSingleProcessPrivilege 3000 wmic.exe Token: SeIncBasePriorityPrivilege 3000 wmic.exe Token: SeCreatePagefilePrivilege 3000 wmic.exe Token: SeBackupPrivilege 3000 wmic.exe Token: SeRestorePrivilege 3000 wmic.exe Token: SeShutdownPrivilege 3000 wmic.exe Token: SeDebugPrivilege 3000 wmic.exe Token: SeSystemEnvironmentPrivilege 3000 wmic.exe Token: SeRemoteShutdownPrivilege 3000 wmic.exe Token: SeUndockPrivilege 3000 wmic.exe Token: SeManageVolumePrivilege 3000 wmic.exe Token: 33 3000 wmic.exe Token: 34 3000 wmic.exe Token: 35 3000 wmic.exe Token: 36 3000 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2192 wrote to memory of 3000 2192 Umbral.exe 73 PID 2192 wrote to memory of 3000 2192 Umbral.exe 73