Behavioral task
behavioral1
Sample
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe
Resource
win7-20241023-en
General
-
Target
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27
-
Size
231KB
-
MD5
729cf3dc131a564c3384ec6a3cf387ce
-
SHA1
3401e42954a2c5de84d2c32ab97e69db54144bd1
-
SHA256
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27
-
SHA512
9bdf9ac4ace3dbef33adaff6db5e5a157f1f7967613c88b26e51e5c7032b20018007bbc6726812482e2dcf8c8ef8f0a62eb779efe4cf0e893f215faab70bf351
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4+Qz/jpaC93op7mGz2tb8e1moJboi:joZtL+EP8+Qz/jpaC93op7mGz6zbR
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1329832303958036501/OYMJTMKLoKnNNc8NB3edzfuIkkJN4DCHXM19OwX-N-0jQ8kBSP32werfqj4BgoqgvqTB
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27
Files
-
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ