umbral | e88b3a06ac0cbf4130b1c66dde276a4062f472a71d2bf72048ffb577318d5979

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GeoLocate (1)/GeoLocate/Src/Files/skid.exe
Size

230KB
MD5

de2d4e3d82dc91ee44c91793de896c7a
SHA1

3b8db665d3666be6a4234c801b9ca93ced36655e
SHA256

2744f1315bfa21aef381540d3ad53bc90cf15a8513905aba442b4610e8f0c337
SHA512

6a257e6df13bd6dcc1452fa692515b955896f1141aad84110ceaad5a3a929607586c849bcfdb161d648e89c53d747a39e564551172fd36c1e440618346b7b40f
SSDEEP

6144:jloZM+rIkd8g+EtXHkv/iD4Ff6Cj5nsAv7OXZkQlPJXb8e1mq/i:BoZtL+EP8t6Cj5nsAv7OXZkQllNq

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/2872-1-0x00000000009E0000-0x0000000000A20000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	skid.exe
Token: SeIncreaseQuotaPrivilege	2884	wmic.exe
Token: SeSecurityPrivilege	2884	wmic.exe
Token: SeTakeOwnershipPrivilege	2884	wmic.exe
Token: SeLoadDriverPrivilege	2884	wmic.exe
Token: SeSystemProfilePrivilege	2884	wmic.exe
Token: SeSystemtimePrivilege	2884	wmic.exe
Token: SeProfSingleProcessPrivilege	2884	wmic.exe
Token: SeIncBasePriorityPrivilege	2884	wmic.exe
Token: SeCreatePagefilePrivilege	2884	wmic.exe
Token: SeBackupPrivilege	2884	wmic.exe
Token: SeRestorePrivilege	2884	wmic.exe
Token: SeShutdownPrivilege	2884	wmic.exe
Token: SeDebugPrivilege	2884	wmic.exe
Token: SeSystemEnvironmentPrivilege	2884	wmic.exe
Token: SeRemoteShutdownPrivilege	2884	wmic.exe
Token: SeUndockPrivilege	2884	wmic.exe
Token: SeManageVolumePrivilege	2884	wmic.exe
Token: 33	2884	wmic.exe
Token: 34	2884	wmic.exe
Token: 35	2884	wmic.exe
Token: SeIncreaseQuotaPrivilege	2884	wmic.exe
Token: SeSecurityPrivilege	2884	wmic.exe
Token: SeTakeOwnershipPrivilege	2884	wmic.exe
Token: SeLoadDriverPrivilege	2884	wmic.exe
Token: SeSystemProfilePrivilege	2884	wmic.exe
Token: SeSystemtimePrivilege	2884	wmic.exe
Token: SeProfSingleProcessPrivilege	2884	wmic.exe
Token: SeIncBasePriorityPrivilege	2884	wmic.exe
Token: SeCreatePagefilePrivilege	2884	wmic.exe
Token: SeBackupPrivilege	2884	wmic.exe
Token: SeRestorePrivilege	2884	wmic.exe
Token: SeShutdownPrivilege	2884	wmic.exe
Token: SeDebugPrivilege	2884	wmic.exe
Token: SeSystemEnvironmentPrivilege	2884	wmic.exe
Token: SeRemoteShutdownPrivilege	2884	wmic.exe
Token: SeUndockPrivilege	2884	wmic.exe
Token: SeManageVolumePrivilege	2884	wmic.exe
Token: 33	2884	wmic.exe
Token: 34	2884	wmic.exe
Token: 35	2884	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2884	2872	skid.exe	28
PID 2872 wrote to memory of 2884	2872	skid.exe	28
PID 2872 wrote to memory of 2884	2872	skid.exe	28

C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe
"C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x00000000009E0000-0x0000000000A20000-memory.dmp

Filesize
256KB

Download
memory/2872-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-3-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download