Overview

overview

10

Static

static

1

intelstub.exe

windows10-ltsc 2021-x64

10

Resubmissions

08-12-2024 02:44

241208-c76qvsykax 10

08-12-2024 02:42

241208-c7bwgstldm 10

08-12-2024 02:40

241208-c6dcxstlal 10

08-12-2024 02:37

241208-c4lxaaxrcv 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    intelstub.exe

  • Size

    45KB

  • Sample

    241208-c76qvsykax

  • MD5

    46dad3f34a1ff25b259446bac02cca4a

  • SHA1

    08be9e8701d40bb0d968106793480eeb25adeb26

  • SHA256

    9bf776f889b56b90ef2cbe8cd971c68290f79374b7a7dcfa100e71a1cd45bd03

  • SHA512

    67338468551bc926a88b8e40f40177dea339debd701ad463f9e2cb763cf82f755743f3ee82c3626aa326c820afb93020d0d9526fc38affcb9b3af92725b393f6

  • SSDEEP

    768:R4yvRGAc8gygFxLgkzLQgzcOybPofSzVxsBKfwJlVE3iPmbL52:9c8Oxz8YcO+A6zV4Kfd7

Score
10/10
umbraldefense_evasionexecutionspywarestealer

Malware Config

Targets

    • Target

      intelstub.exe

    • Size

      45KB

    • MD5

      46dad3f34a1ff25b259446bac02cca4a

    • SHA1

      08be9e8701d40bb0d968106793480eeb25adeb26

    • SHA256

      9bf776f889b56b90ef2cbe8cd971c68290f79374b7a7dcfa100e71a1cd45bd03

    • SHA512

      67338468551bc926a88b8e40f40177dea339debd701ad463f9e2cb763cf82f755743f3ee82c3626aa326c820afb93020d0d9526fc38affcb9b3af92725b393f6

    • SSDEEP

      768:R4yvRGAc8gygFxLgkzLQgzcOybPofSzVxsBKfwJlVE3iPmbL52:9c8Oxz8YcO+A6zV4Kfd7

    Score
    10/10
    umbraldefense_evasionexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks