umbral | 1b9385d02d7257137ac792f32b3109b02a01c720de368c1f334ec8f54638f795 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 04:43

Sharing

Report Analysis Logs

General

Target

Dead Stealer/dead.exe
Size

254KB
MD5

41a555bbc081356100cafdd006d3c096
SHA1

bf4f81ed8b698b9865098fccabff0bbbe3ca3255
SHA256

7e45b79940116f8a1de3a75f82e5209d0279d99479a24778e1590dd739b6ddf8
SHA512

1bc00d609264c523ab114e845a26edb9a611b927a583730880916f04efeee9c37c4529559a47854e422ab8530ab8edbb87754a755f50939c29e5a14e4b74efbc
SSDEEP

6144:+4oZo8KbOUtoAXAEeDh0x7axHU3FmRaW8ejI82V:9oZAOUo90ufIl

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral3/memory/2400-1-0x0000000001090000-0x00000000010D6000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2732	2400	dead.exe	30
PID 2400 wrote to memory of 2732	2400	dead.exe	30
PID 2400 wrote to memory of 2732	2400	dead.exe	30

C:\Users\Admin\AppData\Local\Temp\Dead Stealer\dead.exe
"C:\Users\Admin\AppData\Local\Temp\Dead Stealer\dead.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 544
  2⤵
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x000007FEF5AD3000-0x000007FEF5AD4000-memory.dmp

Filesize
4KB

Download
memory/2400-1-0x0000000001090000-0x00000000010D6000-memory.dmp

Filesize
280KB

Download
memory/2400-2-0x000007FEF5AD3000-0x000007FEF5AD4000-memory.dmp

Filesize
4KB

Download