Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 05:19
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
05396af5253bb6dd42278b146668faac
-
SHA1
44a769f9800ed7675b6b6bd57a6a123b6dc10371
-
SHA256
eacb721b092e628a9699924dad19f4ea4ae1f3d7eb5dce85b5dcd16a273cd78b
-
SHA512
3283964cff79c4fa5319f92bd429c19b0f99ae4a0f518a15882a132177eba60e2ed2ec0fbcfdf273e7e0be646b4f00cee0298a23bef5a83b1985029845f1b916
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4FQpTNbYMTiqL9Y0hU9b8e1msBi:noZtL+EP8FQpTNbYMTiqL9Y0h8w
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1604-1-0x0000000000CB0000-0x0000000000CF0000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1604 Umbral.exe Token: SeIncreaseQuotaPrivilege 3048 wmic.exe Token: SeSecurityPrivilege 3048 wmic.exe Token: SeTakeOwnershipPrivilege 3048 wmic.exe Token: SeLoadDriverPrivilege 3048 wmic.exe Token: SeSystemProfilePrivilege 3048 wmic.exe Token: SeSystemtimePrivilege 3048 wmic.exe Token: SeProfSingleProcessPrivilege 3048 wmic.exe Token: SeIncBasePriorityPrivilege 3048 wmic.exe Token: SeCreatePagefilePrivilege 3048 wmic.exe Token: SeBackupPrivilege 3048 wmic.exe Token: SeRestorePrivilege 3048 wmic.exe Token: SeShutdownPrivilege 3048 wmic.exe Token: SeDebugPrivilege 3048 wmic.exe Token: SeSystemEnvironmentPrivilege 3048 wmic.exe Token: SeRemoteShutdownPrivilege 3048 wmic.exe Token: SeUndockPrivilege 3048 wmic.exe Token: SeManageVolumePrivilege 3048 wmic.exe Token: 33 3048 wmic.exe Token: 34 3048 wmic.exe Token: 35 3048 wmic.exe Token: SeIncreaseQuotaPrivilege 3048 wmic.exe Token: SeSecurityPrivilege 3048 wmic.exe Token: SeTakeOwnershipPrivilege 3048 wmic.exe Token: SeLoadDriverPrivilege 3048 wmic.exe Token: SeSystemProfilePrivilege 3048 wmic.exe Token: SeSystemtimePrivilege 3048 wmic.exe Token: SeProfSingleProcessPrivilege 3048 wmic.exe Token: SeIncBasePriorityPrivilege 3048 wmic.exe Token: SeCreatePagefilePrivilege 3048 wmic.exe Token: SeBackupPrivilege 3048 wmic.exe Token: SeRestorePrivilege 3048 wmic.exe Token: SeShutdownPrivilege 3048 wmic.exe Token: SeDebugPrivilege 3048 wmic.exe Token: SeSystemEnvironmentPrivilege 3048 wmic.exe Token: SeRemoteShutdownPrivilege 3048 wmic.exe Token: SeUndockPrivilege 3048 wmic.exe Token: SeManageVolumePrivilege 3048 wmic.exe Token: 33 3048 wmic.exe Token: 34 3048 wmic.exe Token: 35 3048 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1604 wrote to memory of 3048 1604 Umbral.exe 30 PID 1604 wrote to memory of 3048 1604 Umbral.exe 30 PID 1604 wrote to memory of 3048 1604 Umbral.exe 30