umbral | fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
27-01-2025 17:01

Target

fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0cN.exe
Size

227KB
MD5

89f5085878a5723c112dc7d65e87f2d0
SHA1

e171c8ce7c69aae5b024a58c8e3827abbd22ad0a
SHA256

fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0c
SHA512

77ca815e2c7eb8de08c67c8eed663e1a2d4f541bf020a09380297d24ec5a4a3047909025420b2bb6480a570de9cc53e1ac7f79c341d937b5a43d312ede746017
SSDEEP

6144:eloZMBfsXtioRkts/cnnK6cMlFV1RIywvrYthkijD6frJR8eoy/i:IoZrtlRk83Mlv1RIywvrYthkijD6Cp

Score

10^/10

umbral stealer

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/2808-1-0x00000000001E0000-0x0000000000220000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2916	2808	fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0cN.exe	30
PID 2808 wrote to memory of 2916	2808	fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0cN.exe	30
PID 2808 wrote to memory of 2916	2808	fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0cN.exe	30

C:\Users\Admin\AppData\Local\Temp\fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0cN.exe
"C:\Users\Admin\AppData\Local\Temp\fbef99cfebff61e55e4e068143becaab159985c397a9522e81c4b2e828c5ba0cN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2808 -s 504
  2⤵
  PID:2916

memory/2808-0-0x000007FEF6443000-0x000007FEF6444000-memory.dmp

Filesize
4KB

Download
memory/2808-1-0x00000000001E0000-0x0000000000220000-memory.dmp

Filesize
256KB

Download