Behavioral task
behavioral1
Sample
b9045f409b3fe27fca2b639fd2620043c2d999e04e45f642841b739bb860af8dN.exe
Resource
win7-20240903-en
General
-
Target
b9045f409b3fe27fca2b639fd2620043c2d999e04e45f642841b739bb860af8dN.exe
-
Size
229KB
-
MD5
ba8d399c9ae62d44f0bebcf5cfde9960
-
SHA1
c9e8160c6854459b52f851d516fd0c305b292642
-
SHA256
b9045f409b3fe27fca2b639fd2620043c2d999e04e45f642841b739bb860af8d
-
SHA512
a66f6ba994ad91f645ea68a0e06691bf8d12cfe543f52f763326d2d03b3a3efeee163390503ed44dd65f929a03cbb9cbd2ca52afd5db83f75b1be5dc10fc573a
-
SSDEEP
6144:lloZMHrIkd8g+EtXHkv/iD4Whm7EsyVtGETOMdRYy6b8e1mreMi:noZIL+EP8WhOEsyVtGETOMdRYpd
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1313268797653909504/hRePkp7ZEpI7vle-oSoQrgYdB9VOq9lV_5DXfMgcc26uoB6oVfDx_9CtEaLOGtUEUxia
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9045f409b3fe27fca2b639fd2620043c2d999e04e45f642841b739bb860af8dN.exe
Files
-
b9045f409b3fe27fca2b639fd2620043c2d999e04e45f642841b739bb860af8dN.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ