umbral | cmclient[.]exe | Triage

Resubmissions

21-10-2024 16:05

241021-tjgkhaydmc 10

21-10-2024 15:55

241021-tc1d2azhlm 10

Sharing

General

Target

cmclient.exe
Size

227KB
MD5

2ff5eea0426612b967301396523c9835
SHA1

af092e6d35d0c0c09d07102fb7e4416459b3d056
SHA256

d36f3b379bcafb2f206a5dc18297c0c0fa0fa6afb44f7640da54cd809051b24c
SHA512

d442d98abd61aa7f551e3309028e303c4390ab54bb94149d8bf0022b7faab1d70e40c66875f8d997e2203964dc8213084d50b108e088af5b433dce2c225f7a3c
SSDEEP

6144:+loZM+rIkd8g+EtXHkv/iD46NdMiAfbokxUyzzqZYw8e1m9Qi:ooZtL+EP86NdMiAfbokxUyzzqfWJ

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1281266577064595527/B_5Sh3QVnIz_pnsyGmf0PUMl-kPismq8ChthkRV0DXLIezBCbZG0RnaMiwlvjsEyFy6c

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource yara_rule

sample family_umbral
Umbral family
umbral
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

cmclient.exe

Files

cmclient.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ