Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 19:33
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
232KB
-
MD5
37974e87e6ab2f57a45f6a59f774d5a0
-
SHA1
af8b0ce0a30c70f23ec081cc9c713f200c931241
-
SHA256
d49509d2f27099e6884319fc50b7cecd8cf837ef1af03d9516a558e54bc7b8e8
-
SHA512
1f17d68a77894f28ab09fbec5d9f499425523512de19b81829dda7b613ddd7a2fadc937ed3933f28048a45cc678a79813ad0e767f6585f60286fd45db44f6344
-
SSDEEP
6144:IloZM+rIkd8g+EtXHkv/iD47xX5kuMzvE5lwOffumn/x0i8e1mi5i:WoZtL+EP8795kuMzvE5lwOffumnrpg
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1800-1-0x0000000000370000-0x00000000003B0000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1800 Umbral.exe Token: SeIncreaseQuotaPrivilege 2148 wmic.exe Token: SeSecurityPrivilege 2148 wmic.exe Token: SeTakeOwnershipPrivilege 2148 wmic.exe Token: SeLoadDriverPrivilege 2148 wmic.exe Token: SeSystemProfilePrivilege 2148 wmic.exe Token: SeSystemtimePrivilege 2148 wmic.exe Token: SeProfSingleProcessPrivilege 2148 wmic.exe Token: SeIncBasePriorityPrivilege 2148 wmic.exe Token: SeCreatePagefilePrivilege 2148 wmic.exe Token: SeBackupPrivilege 2148 wmic.exe Token: SeRestorePrivilege 2148 wmic.exe Token: SeShutdownPrivilege 2148 wmic.exe Token: SeDebugPrivilege 2148 wmic.exe Token: SeSystemEnvironmentPrivilege 2148 wmic.exe Token: SeRemoteShutdownPrivilege 2148 wmic.exe Token: SeUndockPrivilege 2148 wmic.exe Token: SeManageVolumePrivilege 2148 wmic.exe Token: 33 2148 wmic.exe Token: 34 2148 wmic.exe Token: 35 2148 wmic.exe Token: SeIncreaseQuotaPrivilege 2148 wmic.exe Token: SeSecurityPrivilege 2148 wmic.exe Token: SeTakeOwnershipPrivilege 2148 wmic.exe Token: SeLoadDriverPrivilege 2148 wmic.exe Token: SeSystemProfilePrivilege 2148 wmic.exe Token: SeSystemtimePrivilege 2148 wmic.exe Token: SeProfSingleProcessPrivilege 2148 wmic.exe Token: SeIncBasePriorityPrivilege 2148 wmic.exe Token: SeCreatePagefilePrivilege 2148 wmic.exe Token: SeBackupPrivilege 2148 wmic.exe Token: SeRestorePrivilege 2148 wmic.exe Token: SeShutdownPrivilege 2148 wmic.exe Token: SeDebugPrivilege 2148 wmic.exe Token: SeSystemEnvironmentPrivilege 2148 wmic.exe Token: SeRemoteShutdownPrivilege 2148 wmic.exe Token: SeUndockPrivilege 2148 wmic.exe Token: SeManageVolumePrivilege 2148 wmic.exe Token: 33 2148 wmic.exe Token: 34 2148 wmic.exe Token: 35 2148 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2148 1800 Umbral.exe 30 PID 1800 wrote to memory of 2148 1800 Umbral.exe 30 PID 1800 wrote to memory of 2148 1800 Umbral.exe 30