8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0

Analysis

max time kernel
61s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 17:06

Target

Umbral.Stealer.zip
Size

3.3MB
MD5

f355889db3ff6bae624f80f41a52e619
SHA1

47f7916272a81d313e70808270c3c351207b890f
SHA256

8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0
SHA512

bff7636f6cc0fadfd6f027e2ebda9e80fd5c64d551b2c666929b2d990509af73b082d739f14bb1497be292eafe703ebd5d7188493e2cc34b73d249fe901820eb
SSDEEP

98304:XINn7mVoLvbDU48xzliDSjtYV2jg0tsGTplmOhl88uF:mjLvvD8BcSjtAB0zplNl8Z

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4932	Umbral.builder.exe
2652	Umbral.builder.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
672	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4932	672	7zFM.exe	105
PID 672 wrote to memory of 4932	672	7zFM.exe	105
PID 672 wrote to memory of 2652	672	7zFM.exe	112
PID 672 wrote to memory of 2652	672	7zFM.exe	112

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Umbral.Stealer.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\7zO0A221E78\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0A221E78\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\7zO0A276598\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0A276598\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:2652

C:\Users\Admin\AppData\Local\Temp\7zO0A221E78\Umbral.builder.exe

Filesize
114KB

MD5
d91fb6867df7e4303d98b5e90faae73c

SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db

SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344

SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9

Download Submit
memory/4932-12-0x00007FFFA0CB3000-0x00007FFFA0CB5000-memory.dmp

Filesize
8KB

Download
memory/4932-13-0x00000227B6730000-0x00000227B6752000-memory.dmp

Filesize
136KB

Download
memory/4932-14-0x00007FFFA0CB0000-0x00007FFFA1771000-memory.dmp

Filesize
10.8MB

Download
memory/4932-15-0x00007FFFA0CB0000-0x00007FFFA1771000-memory.dmp

Filesize
10.8MB

Download