8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0

Analysis

max time kernel
32s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 17:06

Target

Umbral.Stealer.zip
Size

3.3MB
MD5

f355889db3ff6bae624f80f41a52e619
SHA1

47f7916272a81d313e70808270c3c351207b890f
SHA256

8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0
SHA512

bff7636f6cc0fadfd6f027e2ebda9e80fd5c64d551b2c666929b2d990509af73b082d739f14bb1497be292eafe703ebd5d7188493e2cc34b73d249fe901820eb
SSDEEP

98304:XINn7mVoLvbDU48xzliDSjtYV2jg0tsGTplmOhl88uF:mjLvvD8BcSjtAB0zplNl8Z

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
1372	Umbral.builder.exe
2144	Umbral.builder.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	7zFM.exe
1176	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1176	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1372	1176	7zFM.exe	29
PID 1176 wrote to memory of 1372	1176	7zFM.exe	29
PID 1176 wrote to memory of 1372	1176	7zFM.exe	29
PID 1372 wrote to memory of 2900	1372	Umbral.builder.exe	30
PID 1372 wrote to memory of 2900	1372	Umbral.builder.exe	30
PID 1372 wrote to memory of 2900	1372	Umbral.builder.exe	30
PID 1176 wrote to memory of 2144	1176	7zFM.exe	31
PID 1176 wrote to memory of 2144	1176	7zFM.exe	31
PID 1176 wrote to memory of 2144	1176	7zFM.exe	31
PID 2144 wrote to memory of 2928	2144	Umbral.builder.exe	32
PID 2144 wrote to memory of 2928	2144	Umbral.builder.exe	32
PID 2144 wrote to memory of 2928	2144	Umbral.builder.exe	32

C:\Users\Admin\AppData\Local\Temp\7zO89422868\Umbral.builder.exe

Filesize
114KB

MD5
d91fb6867df7e4303d98b5e90faae73c

SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db

SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344

SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9

Download Submit
memory/1372-11-0x00000000003B0000-0x00000000003D2000-memory.dmp

Filesize
136KB

Download
memory/2144-23-0x00000000003F0000-0x0000000000412000-memory.dmp

Filesize
136KB

Download