General
- Target test.exe
- Size 187KB
- Sample240809-bapkmsxdkc
- SHA256 ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093
Malware Config
Targets
-
- Target test.exe
- Size 187KB
- SHA256 ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093
Score10/10-
Detect Umbral payload
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Download via BitsAdmin
-
Drops file in Drivers directory
-
Possible privilege escalation attempt
-
Drops startup file
-
Executes dropped EXE
-
Modifies file permissions
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v15
Defense Evasion
BITS Jobs
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1