umbral

General

Target

test.exe
Size

187KB
Sample

240809-mye7nazcnj
MD5

d6d75d536a2cff983197d333d0230a05
SHA1

cb3872741f661e1f483f7719619ec5c14db15e66
SHA256

cc13206ad514d61c7ea83f9380a571b93e23faafa829b04e877fcd38b4e83b75
SHA512

1219ebdf6ffe7aad099b4af6b9d837acb8183f671736af0bc627fceb18ce69ae9301167afc56277cf20ec7c9fd9f8d537f755bad8fa33c84c8579499a4489c26
SSDEEP

3072:wSV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPE6g0UasVmkoYcMKV:wHt5hBPi0BW69hd1MMdxPe9N9uA069Tx

Score

10^/10

Malware Config

Targets

- Target
  
  test.exe
- Size
  
  187KB
- MD5
  
  d6d75d536a2cff983197d333d0230a05
- SHA1
  
  cb3872741f661e1f483f7719619ec5c14db15e66
- SHA256
  
  cc13206ad514d61c7ea83f9380a571b93e23faafa829b04e877fcd38b4e83b75
- SHA512
  
  1219ebdf6ffe7aad099b4af6b9d837acb8183f671736af0bc627fceb18ce69ae9301167afc56277cf20ec7c9fd9f8d537f755bad8fa33c84c8579499a4489c26
- SSDEEP
  
  3072:wSV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPE6g0UasVmkoYcMKV:wHt5hBPi0BW69hd1MMdxPe9N9uA069Tx
Score

10^/10

umbral credential_access discovery dropper execution exploit ransomware stealer
- Detect Umbral payload
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Download via BitsAdmin
  dropper
- Downloads MZ/PE file
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1