umbral | 1b9385d02d7257137ac792f32b3109b02a01c720de368c1f334ec8f54638f795

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 04:39

Target
Dead Stealer/dead.exe
Size 254KB
Sample240810-facnaszfpc
SHA256 7e45b79940116f8a1de3a75f82e5209d0279d99479a24778e1590dd739b6ddf8
MD5 41a555bbc081356100cafdd006d3c096
SHA1 bf4f81ed8b698b9865098fccabff0bbbe3ca3255
SHA512 1bc00d609264c523ab114e845a26edb9a611b927a583730880916f04efeee9c37c4529559a47854e422ab8530ab8edbb87754a755f50939c29e5a14e4b74efbc
SSDEEP 6144:+4oZo8KbOUtoAXAEeDh0x7axHU3FmRaW8ejI82V:9oZAOUo90ufIl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral stealer

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral3/memory/1212-1-0x0000000000A50000-0x0000000000A96000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2552	1212	dead.exe	30
PID 1212 wrote to memory of 2552	1212	dead.exe	30
PID 1212 wrote to memory of 2552	1212	dead.exe	30

C:\Users\Admin\AppData\Local\Temp\Dead Stealer\dead.exe
"C:\Users\Admin\AppData\Local\Temp\Dead Stealer\dead.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1212 -s 544
  2⤵
  PID:2552

memory/1212-0-0x000007FEF6353000-0x000007FEF6354000-memory.dmp

Download

memory/1212-1-0x0000000000A50000-0x0000000000A96000-memory.dmp

Download