Behavioral task
behavioral1
Sample
31c061c83666b251d96b66caf93b422948e3dfad205d1843dacfbd4ef8a21936.exe
Resource
win7-20241023-en
General
-
Target
31c061c83666b251d96b66caf93b422948e3dfad205d1843dacfbd4ef8a21936
-
Size
235KB
-
MD5
87dd9769f8dac6c5c8f6fb8cd36ba1db
-
SHA1
7cb356796d88dfa8e6a64b5fbcdd98ae6766a736
-
SHA256
31c061c83666b251d96b66caf93b422948e3dfad205d1843dacfbd4ef8a21936
-
SHA512
e14aad1acaea634a10c85137a6a5dd67de43837286474aa37088149e92c0c7090716e62414a8b212632d64e9d9a6bc5c070635ea935d7acd351b3ac1653f48a4
-
SSDEEP
6144:TloZM+rIkd8g+EtXHkv/iD4P4x+NbYMTiqL9Y0he/b8e1msi:RoZtL+EP8P4x+NbYMTiqL9Y0hom
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1248609655085600899/MrVb417QU8fZjEwKLKWE-bla86Obi_ti4F47WjczwzoZrfqpbF7LuwEYH1uRaX20wU5q
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31c061c83666b251d96b66caf93b422948e3dfad205d1843dacfbd4ef8a21936
Files
-
31c061c83666b251d96b66caf93b422948e3dfad205d1843dacfbd4ef8a21936.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ