umbral | 8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 00:56

Sharing

Report Analysis Logs

General

Target

Umbral.exe
Size

230KB
MD5

da7d94f96e8b7f035020b7721e968ec1
SHA1

a30abe39a9e27e5eb76fb509eb4f9edeb7c36f5e
SHA256

23d651ed623affcb1b71457c07c4f887a6ac44b04ceef74850292ab38d1b3287
SHA512

181bf779331cbe6f456a44963004e84d8850e1a61350bae66c4e5001d185740c5fbab44b536e3e055871029db23409db376778488ea1d0098ac89786387bd6e2
SSDEEP

3072:WP+1vofuiMY9QF1c7ROhOtXrLmBGIgXyPyTuuu5bO4ickEw8eFJMwT0kE/0RQ:lQ9Q4XYuTuuufS8eFJLhE

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral4/memory/4224-1-0x000002806F7E0000-0x000002806F820000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4224-0-0x00007FFD85C83000-0x00007FFD85C85000-memory.dmp

Filesize
8KB

Download
memory/4224-1-0x000002806F7E0000-0x000002806F820000-memory.dmp

Filesize
256KB

Download
memory/4224-2-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download
memory/4224-3-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download