Overview

overview

10

Static

static

10

skibidi sk...ay.exe

windows7-x64

10

skibidi sk...ay.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    35s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2024 19:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    skibidi skid who shall i steal today.exe

  • Size

    227KB

  • MD5

    8f0d6e03ee2f791e3270d682778c4a3c

  • SHA1

    0f796d86fc10b2170d4e2875ae4bb7c157c01f67

  • SHA256

    9eefe406aa13dcf0b6e144ac5c78233fca22d813e22091dcfdc13deb82ca1925

  • SHA512

    f3c2521ff9a44cffa41800cf208c3230610bcd6037f76b9220880790106fa0adfea7d626c4aaf7ef4d15136296b5ee2c9fd03e1fde7fde63a74174021db3d2f1

  • SSDEEP

    6144:+loZM+rIkd8g+EtXHkv/iD4BC1bbhS6FAAxDeeb3k2+lb8e1mnwi:ooZtL+EP881bbhS6FAAxDeeb3ktCp

Score
10/10
umbralstealer

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\skibidi skid who shall i steal today.exe
    "C:\Users\Admin\AppData\Local\Temp\skibidi skid who shall i steal today.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1196-0-0x00007FFB1AC13000-0x00007FFB1AC15000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1196-1-0x0000016A0AAF0000-0x0000016A0AB30000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1196-2-0x00007FFB1AC10000-0x00007FFB1B6D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1196-4-0x00007FFB1AC10000-0x00007FFB1B6D1000-memory.dmp

    Filesize

    10.8MB

    Download