umbral | 751dee488d8148db816da1f2326e37e579c116f76e4f8cdf21a25d1f85e74ffe

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Umbral.exe
Size

495KB
MD5

582bc7b05114af523db760bc2380ec80
SHA1

54b26ee9d7cd0f922d5e851696099c4b6fa849f2
SHA256

751dee488d8148db816da1f2326e37e579c116f76e4f8cdf21a25d1f85e74ffe
SHA512

9643b236e15cb9364a1e9cdd322d16d101a9ee804f958565c95037e18fae94d687c2c0c6e7cb776b00aac55e052ef1decce46189b35ffdce8dca74f910b39777
SSDEEP

6144:vloZM+rIkd8g+EtXHkv/iD4zyPvRDAmB5KW/Cwhl0zjb8e1m0iDc:NoZtL+EP8zyPvRDAmB5KW/Cwhl076

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3004-1-0x0000000000E60000-0x0000000000EE2000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com

flow	ioc
6	ip-api.com

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

Umbral.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	3004	Umbral.exe
Token: SeIncreaseQuotaPrivilege	2732	wmic.exe
Token: SeSecurityPrivilege	2732	wmic.exe
Token: SeTakeOwnershipPrivilege	2732	wmic.exe
Token: SeLoadDriverPrivilege	2732	wmic.exe
Token: SeSystemProfilePrivilege	2732	wmic.exe
Token: SeSystemtimePrivilege	2732	wmic.exe
Token: SeProfSingleProcessPrivilege	2732	wmic.exe
Token: SeIncBasePriorityPrivilege	2732	wmic.exe
Token: SeCreatePagefilePrivilege	2732	wmic.exe
Token: SeBackupPrivilege	2732	wmic.exe
Token: SeRestorePrivilege	2732	wmic.exe
Token: SeShutdownPrivilege	2732	wmic.exe
Token: SeDebugPrivilege	2732	wmic.exe
Token: SeSystemEnvironmentPrivilege	2732	wmic.exe
Token: SeRemoteShutdownPrivilege	2732	wmic.exe
Token: SeUndockPrivilege	2732	wmic.exe
Token: SeManageVolumePrivilege	2732	wmic.exe
Token: 33	2732	wmic.exe
Token: 34	2732	wmic.exe
Token: 35	2732	wmic.exe
Token: SeIncreaseQuotaPrivilege	2732	wmic.exe
Token: SeSecurityPrivilege	2732	wmic.exe
Token: SeTakeOwnershipPrivilege	2732	wmic.exe
Token: SeLoadDriverPrivilege	2732	wmic.exe
Token: SeSystemProfilePrivilege	2732	wmic.exe
Token: SeSystemtimePrivilege	2732	wmic.exe
Token: SeProfSingleProcessPrivilege	2732	wmic.exe
Token: SeIncBasePriorityPrivilege	2732	wmic.exe
Token: SeCreatePagefilePrivilege	2732	wmic.exe
Token: SeBackupPrivilege	2732	wmic.exe
Token: SeRestorePrivilege	2732	wmic.exe
Token: SeShutdownPrivilege	2732	wmic.exe
Token: SeDebugPrivilege	2732	wmic.exe
Token: SeSystemEnvironmentPrivilege	2732	wmic.exe
Token: SeRemoteShutdownPrivilege	2732	wmic.exe
Token: SeUndockPrivilege	2732	wmic.exe
Token: SeManageVolumePrivilege	2732	wmic.exe
Token: 33	2732	wmic.exe
Token: 34	2732	wmic.exe
Token: 35	2732	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Umbral.exe

description	pid	process	target process
PID 3004 wrote to memory of 2732	3004	Umbral.exe	wmic.exe
PID 3004 wrote to memory of 2732	3004	Umbral.exe	wmic.exe
PID 3004 wrote to memory of 2732	3004	Umbral.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/3004-1-0x0000000000E60000-0x0000000000EE2000-memory.dmp

Filesize
520KB

Download
memory/3004-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/3004-3-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download