Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 10:46
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
495KB
-
MD5
582bc7b05114af523db760bc2380ec80
-
SHA1
54b26ee9d7cd0f922d5e851696099c4b6fa849f2
-
SHA256
751dee488d8148db816da1f2326e37e579c116f76e4f8cdf21a25d1f85e74ffe
-
SHA512
9643b236e15cb9364a1e9cdd322d16d101a9ee804f958565c95037e18fae94d687c2c0c6e7cb776b00aac55e052ef1decce46189b35ffdce8dca74f910b39777
-
SSDEEP
6144:vloZM+rIkd8g+EtXHkv/iD4zyPvRDAmB5KW/Cwhl0zjb8e1m0iDc:NoZtL+EP8zyPvRDAmB5KW/Cwhl076
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3004-1-0x0000000000E60000-0x0000000000EE2000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3004 Umbral.exe Token: SeIncreaseQuotaPrivilege 2732 wmic.exe Token: SeSecurityPrivilege 2732 wmic.exe Token: SeTakeOwnershipPrivilege 2732 wmic.exe Token: SeLoadDriverPrivilege 2732 wmic.exe Token: SeSystemProfilePrivilege 2732 wmic.exe Token: SeSystemtimePrivilege 2732 wmic.exe Token: SeProfSingleProcessPrivilege 2732 wmic.exe Token: SeIncBasePriorityPrivilege 2732 wmic.exe Token: SeCreatePagefilePrivilege 2732 wmic.exe Token: SeBackupPrivilege 2732 wmic.exe Token: SeRestorePrivilege 2732 wmic.exe Token: SeShutdownPrivilege 2732 wmic.exe Token: SeDebugPrivilege 2732 wmic.exe Token: SeSystemEnvironmentPrivilege 2732 wmic.exe Token: SeRemoteShutdownPrivilege 2732 wmic.exe Token: SeUndockPrivilege 2732 wmic.exe Token: SeManageVolumePrivilege 2732 wmic.exe Token: 33 2732 wmic.exe Token: 34 2732 wmic.exe Token: 35 2732 wmic.exe Token: SeIncreaseQuotaPrivilege 2732 wmic.exe Token: SeSecurityPrivilege 2732 wmic.exe Token: SeTakeOwnershipPrivilege 2732 wmic.exe Token: SeLoadDriverPrivilege 2732 wmic.exe Token: SeSystemProfilePrivilege 2732 wmic.exe Token: SeSystemtimePrivilege 2732 wmic.exe Token: SeProfSingleProcessPrivilege 2732 wmic.exe Token: SeIncBasePriorityPrivilege 2732 wmic.exe Token: SeCreatePagefilePrivilege 2732 wmic.exe Token: SeBackupPrivilege 2732 wmic.exe Token: SeRestorePrivilege 2732 wmic.exe Token: SeShutdownPrivilege 2732 wmic.exe Token: SeDebugPrivilege 2732 wmic.exe Token: SeSystemEnvironmentPrivilege 2732 wmic.exe Token: SeRemoteShutdownPrivilege 2732 wmic.exe Token: SeUndockPrivilege 2732 wmic.exe Token: SeManageVolumePrivilege 2732 wmic.exe Token: 33 2732 wmic.exe Token: 34 2732 wmic.exe Token: 35 2732 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2732 3004 Umbral.exe 30 PID 3004 wrote to memory of 2732 3004 Umbral.exe 30 PID 3004 wrote to memory of 2732 3004 Umbral.exe 30