umbral | e88b3a06ac0cbf4130b1c66dde276a4062f472a71d2bf72048ffb577318d5979

Analysis

max time kernel
30s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GeoLocate (1)/GeoLocate/Src/Files/skid.exe
Size

230KB
MD5

de2d4e3d82dc91ee44c91793de896c7a
SHA1

3b8db665d3666be6a4234c801b9ca93ced36655e
SHA256

2744f1315bfa21aef381540d3ad53bc90cf15a8513905aba442b4610e8f0c337
SHA512

6a257e6df13bd6dcc1452fa692515b955896f1141aad84110ceaad5a3a929607586c849bcfdb161d648e89c53d747a39e564551172fd36c1e440618346b7b40f
SSDEEP

6144:jloZM+rIkd8g+EtXHkv/iD4Ff6Cj5nsAv7OXZkQlPJXb8e1mq/i:BoZtL+EP8t6Cj5nsAv7OXZkQllNq

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/3756-1-0x0000029890EA0000-0x0000029890EE0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	skid.exe
Token: SeIncreaseQuotaPrivilege	1012	wmic.exe
Token: SeSecurityPrivilege	1012	wmic.exe
Token: SeTakeOwnershipPrivilege	1012	wmic.exe
Token: SeLoadDriverPrivilege	1012	wmic.exe
Token: SeSystemProfilePrivilege	1012	wmic.exe
Token: SeSystemtimePrivilege	1012	wmic.exe
Token: SeProfSingleProcessPrivilege	1012	wmic.exe
Token: SeIncBasePriorityPrivilege	1012	wmic.exe
Token: SeCreatePagefilePrivilege	1012	wmic.exe
Token: SeBackupPrivilege	1012	wmic.exe
Token: SeRestorePrivilege	1012	wmic.exe
Token: SeShutdownPrivilege	1012	wmic.exe
Token: SeDebugPrivilege	1012	wmic.exe
Token: SeSystemEnvironmentPrivilege	1012	wmic.exe
Token: SeRemoteShutdownPrivilege	1012	wmic.exe
Token: SeUndockPrivilege	1012	wmic.exe
Token: SeManageVolumePrivilege	1012	wmic.exe
Token: 33	1012	wmic.exe
Token: 34	1012	wmic.exe
Token: 35	1012	wmic.exe
Token: 36	1012	wmic.exe
Token: SeIncreaseQuotaPrivilege	1012	wmic.exe
Token: SeSecurityPrivilege	1012	wmic.exe
Token: SeTakeOwnershipPrivilege	1012	wmic.exe
Token: SeLoadDriverPrivilege	1012	wmic.exe
Token: SeSystemProfilePrivilege	1012	wmic.exe
Token: SeSystemtimePrivilege	1012	wmic.exe
Token: SeProfSingleProcessPrivilege	1012	wmic.exe
Token: SeIncBasePriorityPrivilege	1012	wmic.exe
Token: SeCreatePagefilePrivilege	1012	wmic.exe
Token: SeBackupPrivilege	1012	wmic.exe
Token: SeRestorePrivilege	1012	wmic.exe
Token: SeShutdownPrivilege	1012	wmic.exe
Token: SeDebugPrivilege	1012	wmic.exe
Token: SeSystemEnvironmentPrivilege	1012	wmic.exe
Token: SeRemoteShutdownPrivilege	1012	wmic.exe
Token: SeUndockPrivilege	1012	wmic.exe
Token: SeManageVolumePrivilege	1012	wmic.exe
Token: 33	1012	wmic.exe
Token: 34	1012	wmic.exe
Token: 35	1012	wmic.exe
Token: 36	1012	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1012	3756	skid.exe	86
PID 3756 wrote to memory of 1012	3756	skid.exe	86

C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe
"C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3756-0-0x00007FFB5E483000-0x00007FFB5E485000-memory.dmp

Filesize
8KB

Download
memory/3756-1-0x0000029890EA0000-0x0000029890EE0000-memory.dmp

Filesize
256KB

Download
memory/3756-2-0x00007FFB5E480000-0x00007FFB5EF41000-memory.dmp

Filesize
10.8MB

Download
memory/3756-4-0x00007FFB5E480000-0x00007FFB5EF41000-memory.dmp

Filesize
10.8MB

Download