Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240705-en
General
-
Target
Umbral.exe
-
Size
416KB
-
MD5
bc5dd701f57c7d57c143f1cfd0bb2e0c
-
SHA1
bd5cac1520ccb83442a96ac34cfccf2730591720
-
SHA256
a0b244e1ee7d95f564857f7e481620731d347e5934f4bcc6098a76eb1b71a499
-
SHA512
dca39c9fab005131247cbddbdf3a6a77eeaa9cf3f4c09a9cd3bf2641add1818092e314c9225060b809a45fb1c66db0de2a7d64dfaaeb3b2f73767faab4e897a2
-
SSDEEP
12288:5oZtL+EP8HE3APlO2Z6c1niinSFDA2oCMt/YdD:XI8k3APlO2Z6c1niinSJ6/W
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1273290522475237447/uwLRJdpt5rNkRWA2QRAa__3X857BwfLcNoAy6nM37AZeFagRgsUGSbI5vGd4JlbM3kid
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Umbral.exe
Files
-
Umbral.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ