umbral | e88b3a06ac0cbf4130b1c66dde276a4062f472a71d2bf72048ffb577318d5979

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GeoLocate (1)/GeoLocate/Src/Files/skid.exe
Size

230KB
MD5

de2d4e3d82dc91ee44c91793de896c7a
SHA1

3b8db665d3666be6a4234c801b9ca93ced36655e
SHA256

2744f1315bfa21aef381540d3ad53bc90cf15a8513905aba442b4610e8f0c337
SHA512

6a257e6df13bd6dcc1452fa692515b955896f1141aad84110ceaad5a3a929607586c849bcfdb161d648e89c53d747a39e564551172fd36c1e440618346b7b40f
SSDEEP

6144:jloZM+rIkd8g+EtXHkv/iD4Ff6Cj5nsAv7OXZkQlPJXb8e1mq/i:BoZtL+EP8t6Cj5nsAv7OXZkQllNq

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/1684-1-0x0000000000900000-0x0000000000940000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	skid.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe
Token: SeSystemProfilePrivilege	1664	wmic.exe
Token: SeSystemtimePrivilege	1664	wmic.exe
Token: SeProfSingleProcessPrivilege	1664	wmic.exe
Token: SeIncBasePriorityPrivilege	1664	wmic.exe
Token: SeCreatePagefilePrivilege	1664	wmic.exe
Token: SeBackupPrivilege	1664	wmic.exe
Token: SeRestorePrivilege	1664	wmic.exe
Token: SeShutdownPrivilege	1664	wmic.exe
Token: SeDebugPrivilege	1664	wmic.exe
Token: SeSystemEnvironmentPrivilege	1664	wmic.exe
Token: SeRemoteShutdownPrivilege	1664	wmic.exe
Token: SeUndockPrivilege	1664	wmic.exe
Token: SeManageVolumePrivilege	1664	wmic.exe
Token: 33	1664	wmic.exe
Token: 34	1664	wmic.exe
Token: 35	1664	wmic.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe
Token: SeSystemProfilePrivilege	1664	wmic.exe
Token: SeSystemtimePrivilege	1664	wmic.exe
Token: SeProfSingleProcessPrivilege	1664	wmic.exe
Token: SeIncBasePriorityPrivilege	1664	wmic.exe
Token: SeCreatePagefilePrivilege	1664	wmic.exe
Token: SeBackupPrivilege	1664	wmic.exe
Token: SeRestorePrivilege	1664	wmic.exe
Token: SeShutdownPrivilege	1664	wmic.exe
Token: SeDebugPrivilege	1664	wmic.exe
Token: SeSystemEnvironmentPrivilege	1664	wmic.exe
Token: SeRemoteShutdownPrivilege	1664	wmic.exe
Token: SeUndockPrivilege	1664	wmic.exe
Token: SeManageVolumePrivilege	1664	wmic.exe
Token: 33	1664	wmic.exe
Token: 34	1664	wmic.exe
Token: 35	1664	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1664	1684	skid.exe	30
PID 1684 wrote to memory of 1664	1684	skid.exe	30
PID 1684 wrote to memory of 1664	1684	skid.exe	30

C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe
"C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x0000000000900000-0x0000000000940000-memory.dmp

Filesize
256KB

Download
memory/1684-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1684-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download