umbral | 74e60554bfe9ff20a5a31bd25d5d734619b17deb69d0d3166053d6a48957ed61

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
submitted
23-10-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWormV5.6.exe
Size

14.4MB
MD5

f797a463b2ad1a0527503bf4d46f7fec
SHA1

184bf019868b7c23ab6d21c13a7173ee950aec9b
SHA256

74e60554bfe9ff20a5a31bd25d5d734619b17deb69d0d3166053d6a48957ed61
SHA512

be16df0300e286705f523141a6e2103fecd842d7068e5df47b303dbaac655214c7a28b12d38539238b47185c4812643efd65cb30b8b7cd4491433b930c67369d
SSDEEP

196608:CH/BAe1d4ihvy85JhhYc3BSL1kehn4inje1:CnyIhhkRka4iY

Score

10^/10

umbral xworm discovery execution rat stealer trojan

Malware Config

Extracted

Family

xworm

summer-weekend.gl.at.ply.gg:43101:7777

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aabe-40.dat	family_umbral
behavioral1/memory/3152-47-0x0000025C67F20000-0x0000025C67F60000-memory.dmp	family_umbral
behavioral1/memory/3412-49-0x0000000000400000-0x0000000001278000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aabc-26.dat	family_xworm
behavioral1/memory/3860-48-0x0000000000510000-0x0000000000526000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe
1408	powershell.exe
2824	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient.lnk	WizClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient.lnk	WizClient.exe

Executes dropped EXE 6 IoCs

pid	Process
4252	Xworm V5.6.exe
4292	pl1h4dob.oc1.exe
3860	WizClient.exe
3152	Umbral.exe
2400	WizClient.exe
4208	WizClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormV5.6.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
4292	pl1h4dob.oc1.exe
1408	powershell.exe
1408	powershell.exe
2824	powershell.exe
2824	powershell.exe
2136	powershell.exe
2136	powershell.exe
3860	WizClient.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	pl1h4dob.oc1.exe
Token: SeDebugPrivilege	3860	WizClient.exe
Token: SeDebugPrivilege	3152	Umbral.exe
Token: SeIncreaseQuotaPrivilege	4732	wmic.exe
Token: SeSecurityPrivilege	4732	wmic.exe
Token: SeTakeOwnershipPrivilege	4732	wmic.exe
Token: SeLoadDriverPrivilege	4732	wmic.exe
Token: SeSystemProfilePrivilege	4732	wmic.exe
Token: SeSystemtimePrivilege	4732	wmic.exe
Token: SeProfSingleProcessPrivilege	4732	wmic.exe
Token: SeIncBasePriorityPrivilege	4732	wmic.exe
Token: SeCreatePagefilePrivilege	4732	wmic.exe
Token: SeBackupPrivilege	4732	wmic.exe
Token: SeRestorePrivilege	4732	wmic.exe
Token: SeShutdownPrivilege	4732	wmic.exe
Token: SeDebugPrivilege	4732	wmic.exe
Token: SeSystemEnvironmentPrivilege	4732	wmic.exe
Token: SeRemoteShutdownPrivilege	4732	wmic.exe
Token: SeUndockPrivilege	4732	wmic.exe
Token: SeManageVolumePrivilege	4732	wmic.exe
Token: 33	4732	wmic.exe
Token: 34	4732	wmic.exe
Token: 35	4732	wmic.exe
Token: 36	4732	wmic.exe
Token: SeIncreaseQuotaPrivilege	4732	wmic.exe
Token: SeSecurityPrivilege	4732	wmic.exe
Token: SeTakeOwnershipPrivilege	4732	wmic.exe
Token: SeLoadDriverPrivilege	4732	wmic.exe
Token: SeSystemProfilePrivilege	4732	wmic.exe
Token: SeSystemtimePrivilege	4732	wmic.exe
Token: SeProfSingleProcessPrivilege	4732	wmic.exe
Token: SeIncBasePriorityPrivilege	4732	wmic.exe
Token: SeCreatePagefilePrivilege	4732	wmic.exe
Token: SeBackupPrivilege	4732	wmic.exe
Token: SeRestorePrivilege	4732	wmic.exe
Token: SeShutdownPrivilege	4732	wmic.exe
Token: SeDebugPrivilege	4732	wmic.exe
Token: SeSystemEnvironmentPrivilege	4732	wmic.exe
Token: SeRemoteShutdownPrivilege	4732	wmic.exe
Token: SeUndockPrivilege	4732	wmic.exe
Token: SeManageVolumePrivilege	4732	wmic.exe
Token: 33	4732	wmic.exe
Token: 34	4732	wmic.exe
Token: 35	4732	wmic.exe
Token: 36	4732	wmic.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	3860	WizClient.exe
Token: SeDebugPrivilege	2400	WizClient.exe
Token: SeDebugPrivilege	4208	WizClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3860	WizClient.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4252	3412	XWormV5.6.exe	81
PID 3412 wrote to memory of 4252	3412	XWormV5.6.exe	81
PID 3412 wrote to memory of 4292	3412	XWormV5.6.exe	82
PID 3412 wrote to memory of 4292	3412	XWormV5.6.exe	82
PID 3412 wrote to memory of 3860	3412	XWormV5.6.exe	83
PID 3412 wrote to memory of 3860	3412	XWormV5.6.exe	83
PID 3412 wrote to memory of 3152	3412	XWormV5.6.exe	84
PID 3412 wrote to memory of 3152	3412	XWormV5.6.exe	84
PID 3152 wrote to memory of 4732	3152	Umbral.exe	85
PID 3152 wrote to memory of 4732	3152	Umbral.exe	85
PID 3860 wrote to memory of 1408	3860	WizClient.exe	93
PID 3860 wrote to memory of 1408	3860	WizClient.exe	93
PID 3860 wrote to memory of 2824	3860	WizClient.exe	95
PID 3860 wrote to memory of 2824	3860	WizClient.exe	95
PID 3860 wrote to memory of 2136	3860	WizClient.exe	97
PID 3860 wrote to memory of 2136	3860	WizClient.exe	97
PID 3860 wrote to memory of 5024	3860	WizClient.exe	99
PID 3860 wrote to memory of 5024	3860	WizClient.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWormV5.6.exe
"C:\Users\Admin\AppData\Local\Temp\XWormV5.6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\pl1h4dob.oc1.exe
  "C:\Users\Admin\AppData\Local\Temp\pl1h4dob.oc1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\WizClient.exe
  "C:\Users\Admin\AppData\Local\Temp\WizClient.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient" /tr "C:\Users\Admin\AppData\Roaming\WizClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4732

C:\Users\Admin\AppData\Roaming\WizClient.exe
C:\Users\Admin\AppData\Roaming\WizClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Users\Admin\AppData\Roaming\WizClient.exe
C:\Users\Admin\AppData\Roaming\WizClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WizClient.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
051a74485331f9d9f5014e58ec71566c

SHA1
4ed0256a84f2e95609a0b4d5c249bca624db8fe4

SHA256
3f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888

SHA512
1f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
228KB

MD5
7490f7cc7fe56a351ec6228d6f976b7e

SHA1
25d3d77daf555fafa4ee74bf2552c803ddef0316

SHA256
fdea303425206b38a5f142cf735dd2728bb4ac7665b8172f620166f0a982d756

SHA512
33121e5bb96dcfc6cd59a404b5e04d590b6595ffa5b90313581ad53d92be7bba3375602fd1e9219d60aba220048b928ef0c3539bde87545d922847b666c12b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\WizClient.exe

Filesize
64KB

MD5
6515c9ede7129447b05b328a6856fbda

SHA1
0f2718385e7fd3f08dcf907de7c6fa855b01373b

SHA256
0363de0ca3501ce9b044d76aea0fcb0c0ecef88d6af75b287478bbc83fe4068a

SHA512
0d8dd897c8af4fed24588b50bd5c6ec015d5a45cb7ee0fec2f1249f874594056cd68e73bed5ef39643712b8a8dfd573105293dab93dcc4eee23403d847f99a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe

Filesize
13.1MB

MD5
cfc2f64702d265e24adcc6d66411787c

SHA1
c92b1af02225c6cc1e8a616838182b0872385d6b

SHA256
81ae7d77b9f0b98e72152c8969845a249bfd405eb48f4fb139d642dcd0825e24

SHA512
d6a302664644d00b97993ed615c433edfd5fefb373492ad4e912acbef26ccabf4e35a7471a9089148fc14bb532963a1c15824317999ee09bd454163cfc7567b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hwkpry11.uxm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pl1h4dob.oc1.exe

Filesize
303KB

MD5
c28fdbcd4349cefe45419c5cd28d2125

SHA1
c658f90e6454550649f3d9d66eee564ee53d3410

SHA256
aa06ab9346cefe50494421cfd64b6c60f199961b178cb7db40d5388ab5f018cb

SHA512
7c727c56518b2c24365ae7c1b418a0442a3a9101efd1e50db34dd79f88e0273966894598fbf5496a6311324b61ae2df8b8db0c52ad08be20f15e1d23f7c3d99b

Download Submit
memory/1408-62-0x00000185BD9B0000-0x00000185BD9D2000-memory.dmp

Filesize
136KB

Download
memory/3152-47-0x0000025C67F20000-0x0000025C67F60000-memory.dmp

Filesize
256KB

Download
memory/3412-49-0x0000000000400000-0x0000000001278000-memory.dmp

Filesize
14.5MB

Download
memory/3860-48-0x0000000000510000-0x0000000000526000-memory.dmp

Filesize
88KB

Download
memory/4252-50-0x000001D1B2A10000-0x000001D1B3738000-memory.dmp

Filesize
13.2MB

Download
memory/4252-20-0x00007FFD9E253000-0x00007FFD9E255000-memory.dmp

Filesize
8KB

Download
memory/4292-51-0x00007FFD9E250000-0x00007FFD9ED12000-memory.dmp

Filesize
10.8MB

Download
memory/4292-53-0x00007FFD9E250000-0x00007FFD9ED12000-memory.dmp

Filesize
10.8MB

Download
memory/4292-32-0x00000179EC230000-0x00000179EC280000-memory.dmp

Filesize
320KB

Download