Behavioral task
behavioral1
Sample
6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548N.exe
Resource
win7-20240903-en
General
-
Target
6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548N
-
Size
231KB
-
MD5
bf88437e7f3d92105674eb1d1898ad60
-
SHA1
b05bac32adf9ac7e6d43ea6125e3990d8eab252a
-
SHA256
6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548
-
SHA512
8b97ec767712e8a2e88c22c9ead351a17c21b2b6714b65d440bd9d3555601b7055209ad6dca70d5c4c06425a67dcfba15d6cc6c773d26ee0997c911dc29f212f
-
SSDEEP
6144:RloZMJrIkd8g+EtXHkv/iD4vqU5EKtFunr20VJggTI8e1mEi:joZCL+EP8vqU5EKtFunr20VJgH6
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1283405546807890005/H711uAHISarSH3qsZH2T1W2fX4fmNrhTB3YHn4DzTDrt0_GiXJlts2WXBq2ZAo3ZuwLr
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548N
Files
-
6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ