Analysis
-
max time kernel
47s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
06-01-2025 04:00
General
-
Target
Umbral.Stealer.zip
-
Size
3.3MB
-
MD5
f355889db3ff6bae624f80f41a52e619
-
SHA1
47f7916272a81d313e70808270c3c351207b890f
-
SHA256
8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0
-
SHA512
bff7636f6cc0fadfd6f027e2ebda9e80fd5c64d551b2c666929b2d990509af73b082d739f14bb1497be292eafe703ebd5d7188493e2cc34b73d249fe901820eb
-
SSDEEP
98304:XINn7mVoLvbDU48xzliDSjtYV2jg0tsGTplmOhl88uF:mjLvvD8BcSjtAB0zplNl8Z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Obfuscated with Agile.Net obfuscator 16 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Umbral.Stealer.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Umbral.builder.exe"C:\Users\Admin\Desktop\Umbral.builder.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52b2740e0c34a46de31cf9da8a75d77cf
SHA1242324f1112e6387cda41686291b6e9a415eeb8c
SHA256a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43
SHA512605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40
-
Filesize
342KB
MD541c216d27c71a227774e680e95e99f31
SHA10a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5
SHA256012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305
SHA512e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651
-
Filesize
107KB
MD521f999e5ac72a16077511d41590822de
SHA1d8bb1a8a291f73cdf2b5658b2b65736c87db19dd
SHA2562a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71
SHA512e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3
-
Filesize
102KB
MD5ef11f59a9381df17d7ab94434f79f260
SHA1ec11e46a636fe3927fd5fa7c30be65b958853ef0
SHA256390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4
SHA512612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d
-
Filesize
38KB
MD5539d803013c0b1592d0e17a740d72687
SHA1b0ce15e0f096d027b1d1482afa9d93bafd160f7a
SHA256500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81
SHA51277d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd
-
Filesize
420KB
MD573ca0338c9c3b7901d3621b346c76a7a
SHA179d26ee6e1bf0beb2ee0593562592de8ff01935b
SHA256a505193910f7b8fd6123c00bb437bff3d2a4f28c970e24207d395554765e6ad4
SHA51253e0b84dffbec8e465955bc91f1207ba56a55543ba3c00c66997b3ee3d4cb904e027915a12f7a9dc79ffef4cde633c9b7543436c4ab97785ca2169bc3d4aeede
-
Filesize
45KB
MD5ebaf1a6efa8c7a04d174be7e0df602a7
SHA1ce08c80e52b6cf3f62ba82408d8f32ae6bcef0d8
SHA2561858b16074d7f9b73f462e3adcc77309800594fa96f2e0904c810eda4eaf5e86
SHA5124ffd5dcb59a4a03273c4e88047c7d398f098302b9485d07cf5549ca0d72467102aafa69298e248250df154a8b09f7560e634cca9cb1af2838baf3965aa645b31
-
Filesize
112KB
MD5fd2042c49df3e74e096b8cee8cc9fe43
SHA14ccdb0e13c24fb71f502d50e34f00c39bcacf307
SHA2564569393e1aad7498c6a7c8a84f79d0cd7a1d0656e912d0ddb607b61163673976
SHA512c93ad9cb411c311b0feeefdf2089c0c13098c7d2bab56345f4e9a7fc515965a3893c613d494adbbb066801eeb3dc32237a8322f7a5f876284a06b447efdad641
-
Filesize
114KB
MD5d91fb6867df7e4303d98b5e90faae73c
SHA1496f53ad8cd9381f1c1b577a73e978081002c1db
SHA256bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344
SHA5125dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9
-
Filesize
163B
MD5dccd44fb11b8e4ebdfb822e809a54b6f
SHA11889d5ae8c7c70c051cbde104af6e0f31f8c1b63
SHA2566862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158
SHA512dadffe41bdadfc3a79cb34369c9a8b37ce4833aee18058b02dcb13d64007f022b80b63ab404572c60278937cf83b06b00712ff9ee302e725b9d5c7fe14bd5f50
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
360KB
-
Filesize
128KB
-
Filesize
56KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
1.3MB
-
Filesize
1.1MB
-
Filesize
192KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB