Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240704-en
General
-
Target
Umbral.exe
-
Size
232KB
-
MD5
b19a46354270983374d8a6c2e1de3eff
-
SHA1
1e0c163fd3d63d26dd3f271a3e348b3d69140c7d
-
SHA256
8ff6ca14eac4b42391697608e3cf0c6fe433e58ac965bef66ec32888305464d9
-
SHA512
829a6b6c93c5f98ac8b2633608c6d05247e8b84b9eb188ffaf69a6339019fd92772730325de9ef378812693203abe19cff289b1feb7ca8149dcbeb857d307b6d
-
SSDEEP
6144:BloZM+rIkd8g+EtXHkv/iD4yF4W4+ZRS23q459cTub8e1mQvi:zoZtL+EP8yF4W4+ZRS23q459cmW
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1277722588512129034/-1CdGN8uT-DDAyfx2QemVACEk8llIl7nKhc_0Xo0gB1WQvmFz-N-lYYTHXY6dAJqNVot
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Umbral.exe
Files
-
Umbral.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ