umbral | 421b6a23785737dedb2b5f638e84445b2a9e9fa4f52fb1bcfdbfb3b254828e3a

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

octoware in.exe
Size

230KB
MD5

f5aff3ee2085e59f5549090cb00035e9
SHA1

1d07fb7c1b310450774fb2b3c5b6506421c4b360
SHA256

421b6a23785737dedb2b5f638e84445b2a9e9fa4f52fb1bcfdbfb3b254828e3a
SHA512

05a4072f351eeae93b649c2bb1209aa295cc21a4664a3aed4cb1473351fd0777807f09940f781ccb02cf23060264102b9d893de69822246cb7b34bd7a47bcbc4
SSDEEP

6144:9loZM0rIkd8g+EtXHkv/iD49YaHdmOhjU9va6vDbEtjXk8e1mTLi:foZDL+EP89YaHdmOhjU9va6vvUjKF

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3784-1-0x00000296149A0000-0x00000296149E0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com

flow	ioc
8	ip-api.com

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

octoware in.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	3784	octoware in.exe
Token: SeIncreaseQuotaPrivilege	1496	wmic.exe
Token: SeSecurityPrivilege	1496	wmic.exe
Token: SeTakeOwnershipPrivilege	1496	wmic.exe
Token: SeLoadDriverPrivilege	1496	wmic.exe
Token: SeSystemProfilePrivilege	1496	wmic.exe
Token: SeSystemtimePrivilege	1496	wmic.exe
Token: SeProfSingleProcessPrivilege	1496	wmic.exe
Token: SeIncBasePriorityPrivilege	1496	wmic.exe
Token: SeCreatePagefilePrivilege	1496	wmic.exe
Token: SeBackupPrivilege	1496	wmic.exe
Token: SeRestorePrivilege	1496	wmic.exe
Token: SeShutdownPrivilege	1496	wmic.exe
Token: SeDebugPrivilege	1496	wmic.exe
Token: SeSystemEnvironmentPrivilege	1496	wmic.exe
Token: SeRemoteShutdownPrivilege	1496	wmic.exe
Token: SeUndockPrivilege	1496	wmic.exe
Token: SeManageVolumePrivilege	1496	wmic.exe
Token: 33	1496	wmic.exe
Token: 34	1496	wmic.exe
Token: 35	1496	wmic.exe
Token: 36	1496	wmic.exe
Token: SeIncreaseQuotaPrivilege	1496	wmic.exe
Token: SeSecurityPrivilege	1496	wmic.exe
Token: SeTakeOwnershipPrivilege	1496	wmic.exe
Token: SeLoadDriverPrivilege	1496	wmic.exe
Token: SeSystemProfilePrivilege	1496	wmic.exe
Token: SeSystemtimePrivilege	1496	wmic.exe
Token: SeProfSingleProcessPrivilege	1496	wmic.exe
Token: SeIncBasePriorityPrivilege	1496	wmic.exe
Token: SeCreatePagefilePrivilege	1496	wmic.exe
Token: SeBackupPrivilege	1496	wmic.exe
Token: SeRestorePrivilege	1496	wmic.exe
Token: SeShutdownPrivilege	1496	wmic.exe
Token: SeDebugPrivilege	1496	wmic.exe
Token: SeSystemEnvironmentPrivilege	1496	wmic.exe
Token: SeRemoteShutdownPrivilege	1496	wmic.exe
Token: SeUndockPrivilege	1496	wmic.exe
Token: SeManageVolumePrivilege	1496	wmic.exe
Token: 33	1496	wmic.exe
Token: 34	1496	wmic.exe
Token: 35	1496	wmic.exe
Token: 36	1496	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

octoware in.exe

description	pid	process	target process
PID 3784 wrote to memory of 1496	3784	octoware in.exe	wmic.exe
PID 3784 wrote to memory of 1496	3784	octoware in.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\octoware in.exe
"C:\Users\Admin\AppData\Local\Temp\octoware in.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-0-0x00007FF865413000-0x00007FF865415000-memory.dmp

Filesize
8KB

Download
memory/3784-1-0x00000296149A0000-0x00000296149E0000-memory.dmp

Filesize
256KB

Download
memory/3784-2-0x00007FF865410000-0x00007FF865ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3784-4-0x00007FF865410000-0x00007FF865ED1000-memory.dmp

Filesize
10.8MB

Download