Analysis

  • max time kernel
    134s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2024, 19:34

General

  • Target

    5658f42d6332d99827d772a710d74e905f822d23e958c86f802973c2cffe850f.exe

  • Size

    227KB

  • MD5

    7f32dcbb00de079c31ff7895ae9c0560

  • SHA1

    e80841a355b8dce9955b9bbba63f02a4ad31a836

  • SHA256

    5658f42d6332d99827d772a710d74e905f822d23e958c86f802973c2cffe850f

  • SHA512

    776cabc7d2442d90655eec0f434c811146b7f569dbace3c8609a582c167af5990ec25d1d7a8eb111744cecbdcd43d37af7d623eb97eb414ad926371083f7aadc

  • SSDEEP

    6144:bloZM+9EB1/SqctonEPfCqAu0+prdmK13Up7a6rhgj8e1m5l:5oZQdSqcwvu0+prdmK13Up7a6rhQM

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5658f42d6332d99827d772a710d74e905f822d23e958c86f802973c2cffe850f.exe
    "C:\Users\Admin\AppData\Local\Temp\5658f42d6332d99827d772a710d74e905f822d23e958c86f802973c2cffe850f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3208-0-0x00007FFE58A43000-0x00007FFE58A45000-memory.dmp

    Filesize

    8KB

  • memory/3208-1-0x00000195D0A30000-0x00000195D0A70000-memory.dmp

    Filesize

    256KB

  • memory/3208-2-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

  • memory/3208-4-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB