umbral | e88b3a06ac0cbf4130b1c66dde276a4062f472a71d2bf72048ffb577318d5979

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GeoLocate (1)/GeoLocate/Src/Files/skid.exe
Size

230KB
MD5

de2d4e3d82dc91ee44c91793de896c7a
SHA1

3b8db665d3666be6a4234c801b9ca93ced36655e
SHA256

2744f1315bfa21aef381540d3ad53bc90cf15a8513905aba442b4610e8f0c337
SHA512

6a257e6df13bd6dcc1452fa692515b955896f1141aad84110ceaad5a3a929607586c849bcfdb161d648e89c53d747a39e564551172fd36c1e440618346b7b40f
SSDEEP

6144:jloZM+rIkd8g+EtXHkv/iD4Ff6Cj5nsAv7OXZkQlPJXb8e1mq/i:BoZtL+EP8t6Cj5nsAv7OXZkQllNq

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/628-1-0x00000146A3D90000-0x00000146A3DD0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	skid.exe
Token: SeIncreaseQuotaPrivilege	4664	wmic.exe
Token: SeSecurityPrivilege	4664	wmic.exe
Token: SeTakeOwnershipPrivilege	4664	wmic.exe
Token: SeLoadDriverPrivilege	4664	wmic.exe
Token: SeSystemProfilePrivilege	4664	wmic.exe
Token: SeSystemtimePrivilege	4664	wmic.exe
Token: SeProfSingleProcessPrivilege	4664	wmic.exe
Token: SeIncBasePriorityPrivilege	4664	wmic.exe
Token: SeCreatePagefilePrivilege	4664	wmic.exe
Token: SeBackupPrivilege	4664	wmic.exe
Token: SeRestorePrivilege	4664	wmic.exe
Token: SeShutdownPrivilege	4664	wmic.exe
Token: SeDebugPrivilege	4664	wmic.exe
Token: SeSystemEnvironmentPrivilege	4664	wmic.exe
Token: SeRemoteShutdownPrivilege	4664	wmic.exe
Token: SeUndockPrivilege	4664	wmic.exe
Token: SeManageVolumePrivilege	4664	wmic.exe
Token: 33	4664	wmic.exe
Token: 34	4664	wmic.exe
Token: 35	4664	wmic.exe
Token: 36	4664	wmic.exe
Token: SeIncreaseQuotaPrivilege	4664	wmic.exe
Token: SeSecurityPrivilege	4664	wmic.exe
Token: SeTakeOwnershipPrivilege	4664	wmic.exe
Token: SeLoadDriverPrivilege	4664	wmic.exe
Token: SeSystemProfilePrivilege	4664	wmic.exe
Token: SeSystemtimePrivilege	4664	wmic.exe
Token: SeProfSingleProcessPrivilege	4664	wmic.exe
Token: SeIncBasePriorityPrivilege	4664	wmic.exe
Token: SeCreatePagefilePrivilege	4664	wmic.exe
Token: SeBackupPrivilege	4664	wmic.exe
Token: SeRestorePrivilege	4664	wmic.exe
Token: SeShutdownPrivilege	4664	wmic.exe
Token: SeDebugPrivilege	4664	wmic.exe
Token: SeSystemEnvironmentPrivilege	4664	wmic.exe
Token: SeRemoteShutdownPrivilege	4664	wmic.exe
Token: SeUndockPrivilege	4664	wmic.exe
Token: SeManageVolumePrivilege	4664	wmic.exe
Token: 33	4664	wmic.exe
Token: 34	4664	wmic.exe
Token: 35	4664	wmic.exe
Token: 36	4664	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4664	628	skid.exe	85
PID 628 wrote to memory of 4664	628	skid.exe	85

C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe
"C:\Users\Admin\AppData\Local\Temp\GeoLocate (1)\GeoLocate\Src\Files\skid.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-0-0x00007FFF17D33000-0x00007FFF17D35000-memory.dmp

Filesize
8KB

Download
memory/628-1-0x00000146A3D90000-0x00000146A3DD0000-memory.dmp

Filesize
256KB

Download
memory/628-2-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download
memory/628-4-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download