umbral | b4b6f0ce548f5ec6207bf0f8350011f953ef5d4011ff288ef5e2e0376cc18ded

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-10-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Perm Spoofer/dumped files/fixserials.exe
Size

229KB
MD5

9252505656ab18c34d4ecff6a7f86263
SHA1

dfa01cbe5c99fbf67a5063f99c67669382e43356
SHA256

78da8433390c0aaf2e5f748ff266bacad23fe9d05b1834eabceeb6ad69859589
SHA512

5e270de9982c3137c16e32fa4c88f9a414893c623fbcdd5cb2f3ff9bbf82eac82bb8d01100d60ea8633da875b36df39d657a9090e393d4fdf717575821bce8a5
SSDEEP

6144:lloZMcrIkd8g+EtXHkv/iD4l6qZEKtFu9r20VJgU8b8e1mbDi:noZrL+EP8l6qZEKtFu9r20VJgZd

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral26/memory/2544-1-0x0000000000270000-0x00000000002B0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	fixserials.exe
Token: SeIncreaseQuotaPrivilege	2500	wmic.exe
Token: SeSecurityPrivilege	2500	wmic.exe
Token: SeTakeOwnershipPrivilege	2500	wmic.exe
Token: SeLoadDriverPrivilege	2500	wmic.exe
Token: SeSystemProfilePrivilege	2500	wmic.exe
Token: SeSystemtimePrivilege	2500	wmic.exe
Token: SeProfSingleProcessPrivilege	2500	wmic.exe
Token: SeIncBasePriorityPrivilege	2500	wmic.exe
Token: SeCreatePagefilePrivilege	2500	wmic.exe
Token: SeBackupPrivilege	2500	wmic.exe
Token: SeRestorePrivilege	2500	wmic.exe
Token: SeShutdownPrivilege	2500	wmic.exe
Token: SeDebugPrivilege	2500	wmic.exe
Token: SeSystemEnvironmentPrivilege	2500	wmic.exe
Token: SeRemoteShutdownPrivilege	2500	wmic.exe
Token: SeUndockPrivilege	2500	wmic.exe
Token: SeManageVolumePrivilege	2500	wmic.exe
Token: 33	2500	wmic.exe
Token: 34	2500	wmic.exe
Token: 35	2500	wmic.exe
Token: SeIncreaseQuotaPrivilege	2500	wmic.exe
Token: SeSecurityPrivilege	2500	wmic.exe
Token: SeTakeOwnershipPrivilege	2500	wmic.exe
Token: SeLoadDriverPrivilege	2500	wmic.exe
Token: SeSystemProfilePrivilege	2500	wmic.exe
Token: SeSystemtimePrivilege	2500	wmic.exe
Token: SeProfSingleProcessPrivilege	2500	wmic.exe
Token: SeIncBasePriorityPrivilege	2500	wmic.exe
Token: SeCreatePagefilePrivilege	2500	wmic.exe
Token: SeBackupPrivilege	2500	wmic.exe
Token: SeRestorePrivilege	2500	wmic.exe
Token: SeShutdownPrivilege	2500	wmic.exe
Token: SeDebugPrivilege	2500	wmic.exe
Token: SeSystemEnvironmentPrivilege	2500	wmic.exe
Token: SeRemoteShutdownPrivilege	2500	wmic.exe
Token: SeUndockPrivilege	2500	wmic.exe
Token: SeManageVolumePrivilege	2500	wmic.exe
Token: 33	2500	wmic.exe
Token: 34	2500	wmic.exe
Token: 35	2500	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2500	2544	fixserials.exe	31
PID 2544 wrote to memory of 2500	2544	fixserials.exe	31
PID 2544 wrote to memory of 2500	2544	fixserials.exe	31

C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\fixserials.exe
"C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\fixserials.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-0-0x000007FEF52A3000-0x000007FEF52A4000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2544-2-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-3-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Filesize
9.9MB

Download