Behavioral task
behavioral1
Sample
e9585371c2455ea483f3603b5cf1f9d5756e2539bdaabcf91349f19007c59d42N.exe
Resource
win7-20240729-en
General
-
Target
e9585371c2455ea483f3603b5cf1f9d5756e2539bdaabcf91349f19007c59d42N
-
Size
312KB
-
MD5
2f2364e31c5e0194321d8ef18948ca60
-
SHA1
164d0848c47557ab54fa08a1e21214d93ee79db9
-
SHA256
e9585371c2455ea483f3603b5cf1f9d5756e2539bdaabcf91349f19007c59d42
-
SHA512
20ea520f1b5b928f1a249c8240edeb646d33cefd4b31b41fdd7b1dd80f4e18670008d262b7e617d033c2d8049032a7a03007fd5d865e32d1e0bbabacd388ab6f
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4kBO8n9GuBm0dP6aP4Pb8e1m3iQsAGPi5PzRgJZc5:noZtL+EP8kBO8n9GuBm0dP6aPCxQsVGC
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1294031583464001626/T_APWFc-njNFVWHut8KblFYn3cZSblnmuN5JZDISRteNvHoF424XjqXCWpy8yAN6Ik1p
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9585371c2455ea483f3603b5cf1f9d5756e2539bdaabcf91349f19007c59d42N
Files
-
e9585371c2455ea483f3603b5cf1f9d5756e2539bdaabcf91349f19007c59d42N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ