umbral | e6f71ac80e3dab87309de89a4840824b680ae897c19bda25a766b216595f30c5

Analysis

max time kernel
12s
max time network
15s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-11-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fortnite.exe
Size

227KB
MD5

9b107d5d9f8df40eb30e3168ebe6f9dd
SHA1

6b61781552e8173e5bc446128b0683e3dde7ad68
SHA256

e6f71ac80e3dab87309de89a4840824b680ae897c19bda25a766b216595f30c5
SHA512

0a504481a0413a3de4d0e6e2a000a2371be46d6896c399b635f8e3ad7b5a777678a82502a2ec02ead689068c1a7ca9ceffddc7ce47607eff405dde9b7eaeb7fc
SSDEEP

6144:eloZM+rIkd8g+EtXHkv/iD45CcwZCl38e1mBi:IoZtL+EP8RNZ

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4836-1-0x000001C46AAA0000-0x000001C46AAE0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ip-api.com
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

wmic.exe

pid process

4844 wmic.exe
4844 wmic.exe
4844 wmic.exe
4844 wmic.exe

flow	ioc
9	ip-api.com

pid	process
4844	wmic.exe
4844	wmic.exe
4844	wmic.exe
4844	wmic.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

Fortnite.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	4836	Fortnite.exe
Token: SeIncreaseQuotaPrivilege	4844	wmic.exe
Token: SeSecurityPrivilege	4844	wmic.exe
Token: SeTakeOwnershipPrivilege	4844	wmic.exe
Token: SeLoadDriverPrivilege	4844	wmic.exe
Token: SeSystemProfilePrivilege	4844	wmic.exe
Token: SeSystemtimePrivilege	4844	wmic.exe
Token: SeProfSingleProcessPrivilege	4844	wmic.exe
Token: SeIncBasePriorityPrivilege	4844	wmic.exe
Token: SeCreatePagefilePrivilege	4844	wmic.exe
Token: SeBackupPrivilege	4844	wmic.exe
Token: SeRestorePrivilege	4844	wmic.exe
Token: SeShutdownPrivilege	4844	wmic.exe
Token: SeDebugPrivilege	4844	wmic.exe
Token: SeSystemEnvironmentPrivilege	4844	wmic.exe
Token: SeRemoteShutdownPrivilege	4844	wmic.exe
Token: SeUndockPrivilege	4844	wmic.exe
Token: SeManageVolumePrivilege	4844	wmic.exe
Token: 33	4844	wmic.exe
Token: 34	4844	wmic.exe
Token: 35	4844	wmic.exe
Token: 36	4844	wmic.exe
Token: SeIncreaseQuotaPrivilege	4844	wmic.exe
Token: SeSecurityPrivilege	4844	wmic.exe
Token: SeTakeOwnershipPrivilege	4844	wmic.exe
Token: SeLoadDriverPrivilege	4844	wmic.exe
Token: SeSystemProfilePrivilege	4844	wmic.exe
Token: SeSystemtimePrivilege	4844	wmic.exe
Token: SeProfSingleProcessPrivilege	4844	wmic.exe
Token: SeIncBasePriorityPrivilege	4844	wmic.exe
Token: SeCreatePagefilePrivilege	4844	wmic.exe
Token: SeBackupPrivilege	4844	wmic.exe
Token: SeRestorePrivilege	4844	wmic.exe
Token: SeShutdownPrivilege	4844	wmic.exe
Token: SeDebugPrivilege	4844	wmic.exe
Token: SeSystemEnvironmentPrivilege	4844	wmic.exe
Token: SeRemoteShutdownPrivilege	4844	wmic.exe
Token: SeUndockPrivilege	4844	wmic.exe
Token: SeManageVolumePrivilege	4844	wmic.exe
Token: 33	4844	wmic.exe
Token: 34	4844	wmic.exe
Token: 35	4844	wmic.exe
Token: 36	4844	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Fortnite.exe

description pid process target process

PID 4836 wrote to memory of 4844 4836 Fortnite.exe wmic.exe
PID 4836 wrote to memory of 4844 4836 Fortnite.exe wmic.exe

description	pid	process	target process
PID 4836 wrote to memory of 4844	4836	Fortnite.exe	wmic.exe
PID 4836 wrote to memory of 4844	4836	Fortnite.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\Fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4836-0-0x00007FFF848C3000-0x00007FFF848C5000-memory.dmp

Filesize
8KB

Download
memory/4836-1-0x000001C46AAA0000-0x000001C46AAE0000-memory.dmp

Filesize
256KB

Download
memory/4836-2-0x00007FFF848C0000-0x00007FFF85382000-memory.dmp

Filesize
10.8MB

Download
memory/4836-4-0x00007FFF848C0000-0x00007FFF85382000-memory.dmp

Filesize
10.8MB

Download