Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2024 18:26

General

  • Target

    BootstrapperV1.13.exe

  • Size

    229KB

  • MD5

    224b37147484176752b12af33b9efd96

  • SHA1

    d2fbb87ff49e0e80e8585b449fac349688d02f23

  • SHA256

    2133a2c5f4a04d8ffe1ea436d035917ad16c50fa011b021c95c71f2660e67033

  • SHA512

    e374e69dad1b3ad39887163e6c8cd07a88e36b167b91b0eeb8a5296f7345ea4c97e6e8e009193b321524f5326118900933e4657b0177b702036525d42c508704

  • SSDEEP

    6144:9loZM+rIkd8g+EtXHkv/iD4lePZsyVtG/TOMdRYz7b8e1m4i:foZtL+EP8lePZsyVtG/TOMdRYDu

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.13.exe
    "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.13.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1500-0-0x00007FFD03D13000-0x00007FFD03D15000-memory.dmp

    Filesize

    8KB

  • memory/1500-1-0x0000020CF14A0000-0x0000020CF14E0000-memory.dmp

    Filesize

    256KB

  • memory/1500-2-0x00007FFD03D10000-0x00007FFD047D1000-memory.dmp

    Filesize

    10.8MB

  • memory/1500-3-0x00007FFD03D13000-0x00007FFD03D15000-memory.dmp

    Filesize

    8KB

  • memory/1500-4-0x00007FFD03D10000-0x00007FFD047D1000-memory.dmp

    Filesize

    10.8MB