umbral | dd0f083b53019355be2e48e58bbe0c6fd98a180e2921f7709984d228cb6e467f

Analysis

max time kernel
424s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Huy.exe
Size

230KB
MD5

107fbd66e307aec7540e2cd20a9bcb34
SHA1

3b9b1aaae9f92d76f3004797d61e00ab2e8827e7
SHA256

dd0f083b53019355be2e48e58bbe0c6fd98a180e2921f7709984d228cb6e467f
SHA512

754ad589254db37d7e4cc9d88edbeb7f65237932bd432e2d5f69bbe0eb194e4bec372db8e7b0dc5114498b02e8022261b6662a683961d7c391647dbaa0dcc2ae
SSDEEP

6144:1loZM+rIkd8g+EtXHkv/iD4wsTRdLocDXabtIExfG2b8e1mnn8i:XoZtL+EP8wsTRdLocDXabtIExBAV

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/748-1-0x0000017F3FBA0000-0x0000017F3FBE0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3796	mspaint.exe
3796	mspaint.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	Huy.exe
Token: SeIncreaseQuotaPrivilege	3736	wmic.exe
Token: SeSecurityPrivilege	3736	wmic.exe
Token: SeTakeOwnershipPrivilege	3736	wmic.exe
Token: SeLoadDriverPrivilege	3736	wmic.exe
Token: SeSystemProfilePrivilege	3736	wmic.exe
Token: SeSystemtimePrivilege	3736	wmic.exe
Token: SeProfSingleProcessPrivilege	3736	wmic.exe
Token: SeIncBasePriorityPrivilege	3736	wmic.exe
Token: SeCreatePagefilePrivilege	3736	wmic.exe
Token: SeBackupPrivilege	3736	wmic.exe
Token: SeRestorePrivilege	3736	wmic.exe
Token: SeShutdownPrivilege	3736	wmic.exe
Token: SeDebugPrivilege	3736	wmic.exe
Token: SeSystemEnvironmentPrivilege	3736	wmic.exe
Token: SeRemoteShutdownPrivilege	3736	wmic.exe
Token: SeUndockPrivilege	3736	wmic.exe
Token: SeManageVolumePrivilege	3736	wmic.exe
Token: 33	3736	wmic.exe
Token: 34	3736	wmic.exe
Token: 35	3736	wmic.exe
Token: 36	3736	wmic.exe
Token: SeIncreaseQuotaPrivilege	3736	wmic.exe
Token: SeSecurityPrivilege	3736	wmic.exe
Token: SeTakeOwnershipPrivilege	3736	wmic.exe
Token: SeLoadDriverPrivilege	3736	wmic.exe
Token: SeSystemProfilePrivilege	3736	wmic.exe
Token: SeSystemtimePrivilege	3736	wmic.exe
Token: SeProfSingleProcessPrivilege	3736	wmic.exe
Token: SeIncBasePriorityPrivilege	3736	wmic.exe
Token: SeCreatePagefilePrivilege	3736	wmic.exe
Token: SeBackupPrivilege	3736	wmic.exe
Token: SeRestorePrivilege	3736	wmic.exe
Token: SeShutdownPrivilege	3736	wmic.exe
Token: SeDebugPrivilege	3736	wmic.exe
Token: SeSystemEnvironmentPrivilege	3736	wmic.exe
Token: SeRemoteShutdownPrivilege	3736	wmic.exe
Token: SeUndockPrivilege	3736	wmic.exe
Token: SeManageVolumePrivilege	3736	wmic.exe
Token: 33	3736	wmic.exe
Token: 34	3736	wmic.exe
Token: 35	3736	wmic.exe
Token: 36	3736	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3796	mspaint.exe
4432	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3736	748	Huy.exe	84
PID 748 wrote to memory of 3736	748	Huy.exe	84

C:\Users\Admin\AppData\Local\Temp\Huy.exe
"C:\Users\Admin\AppData\Local\Temp\Huy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3736

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\MoveEnable.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-0-0x00007FFC5DD73000-0x00007FFC5DD75000-memory.dmp

Filesize
8KB

Download
memory/748-1-0x0000017F3FBA0000-0x0000017F3FBE0000-memory.dmp

Filesize
256KB

Download
memory/748-2-0x00007FFC5DD70000-0x00007FFC5E831000-memory.dmp

Filesize
10.8MB

Download
memory/748-4-0x00007FFC5DD70000-0x00007FFC5E831000-memory.dmp

Filesize
10.8MB

Download
memory/4716-9-0x000001C9CFDA0000-0x000001C9CFDB0000-memory.dmp

Filesize
64KB

Download
memory/4716-5-0x000001C9CFD60000-0x000001C9CFD70000-memory.dmp

Filesize
64KB

Download
memory/4716-16-0x000001C9D88E0000-0x000001C9D88E1000-memory.dmp

Filesize
4KB

Download
memory/4716-18-0x000001C9D8960000-0x000001C9D8961000-memory.dmp

Filesize
4KB

Download
memory/4716-20-0x000001C9D8960000-0x000001C9D8961000-memory.dmp

Filesize
4KB

Download
memory/4716-21-0x000001C9D89F0000-0x000001C9D89F1000-memory.dmp

Filesize
4KB

Download
memory/4716-22-0x000001C9D89F0000-0x000001C9D89F1000-memory.dmp

Filesize
4KB

Download
memory/4716-23-0x000001C9D8A00000-0x000001C9D8A01000-memory.dmp

Filesize
4KB

Download
memory/4716-24-0x000001C9D8A00000-0x000001C9D8A01000-memory.dmp

Filesize
4KB

Download