Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 05:25
Behavioral task
behavioral1
Sample
Umbra1.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Umbra1.exe
-
Size
227KB
-
MD5
e05f912c51e4a9928935a2738eab71fb
-
SHA1
d200445ad98692386f1980466139533e8e63903c
-
SHA256
f1957d71c46891f4531175340ff6d01cfab6ec22f17bec699bfa0c803c0964dc
-
SHA512
35bb91dd64598ddf2c839097b398c1aa685b82abf60781fc1684d26490c096c3adc3f6cfa4f56be4d2a5aa6ac987acd369626072735d0e16185f55dfc53163e7
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4A0CoNbYMTUqL9Y0hIVb8e1m7i:IoZtL+EP8A0CoNbYMTUqL9Y0hYx
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2248-1-0x0000000000F90000-0x0000000000FD0000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2248 Umbra1.exe Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2736 2248 Umbra1.exe 30 PID 2248 wrote to memory of 2736 2248 Umbra1.exe 30 PID 2248 wrote to memory of 2736 2248 Umbra1.exe 30