umbral | ed5fe58c45c8b0e48c4c9405ba8065234090e19e145465117e0d2342f43fd872

Analysis

max time kernel
25s
max time network
14s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250207-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-02-2025 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krampus.rar
Size

79KB
MD5

75feae218b03a45d1be3f932f353db7b
SHA1

2eef6e858b38c3c5fece824be164debe55e66f2c
SHA256

ed5fe58c45c8b0e48c4c9405ba8065234090e19e145465117e0d2342f43fd872
SHA512

f13949102f6d6117af5f976cd60dc95315b2be20379d2f7bf4606feffa795a69238d1a84f30288d7e1b45fb407dca583bd17cc9cae3bf129feeb4c2526a0a831
SSDEEP

1536:QLU12qQoZKf09z7AgmdFlLLpfOi96k3wu/ad5Z3uxj7TOpYrJtJ4:QmhgqQgmVLx925ZYX/e

Score

10^/10

umbral stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1225264880039235738/46bNxRt60w9YjuGcjqkvDLT2Saa0gXhoe7P2-CbuUHwdxfwONEkNG92CHxRK6S67a3Bd

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000027f13-4.dat	family_umbral
behavioral1/memory/4808-7-0x000001AB43970000-0x000001AB439B0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Executes dropped EXE 1 IoCs

pid	Process
4808	b5uEJHZB6Rl.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3476	wmic.exe
3476	wmic.exe
3476	wmic.exe
3476	wmic.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3612	7zFM.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	3612	7zFM.exe
Token: 35	3612	7zFM.exe
Token: SeSecurityPrivilege	3612	7zFM.exe
Token: SeDebugPrivilege	4808	b5uEJHZB6Rl.exe
Token: SeIncreaseQuotaPrivilege	3476	wmic.exe
Token: SeSecurityPrivilege	3476	wmic.exe
Token: SeTakeOwnershipPrivilege	3476	wmic.exe
Token: SeLoadDriverPrivilege	3476	wmic.exe
Token: SeSystemProfilePrivilege	3476	wmic.exe
Token: SeSystemtimePrivilege	3476	wmic.exe
Token: SeProfSingleProcessPrivilege	3476	wmic.exe
Token: SeIncBasePriorityPrivilege	3476	wmic.exe
Token: SeCreatePagefilePrivilege	3476	wmic.exe
Token: SeBackupPrivilege	3476	wmic.exe
Token: SeRestorePrivilege	3476	wmic.exe
Token: SeShutdownPrivilege	3476	wmic.exe
Token: SeDebugPrivilege	3476	wmic.exe
Token: SeSystemEnvironmentPrivilege	3476	wmic.exe
Token: SeRemoteShutdownPrivilege	3476	wmic.exe
Token: SeUndockPrivilege	3476	wmic.exe
Token: SeManageVolumePrivilege	3476	wmic.exe
Token: 33	3476	wmic.exe
Token: 34	3476	wmic.exe
Token: 35	3476	wmic.exe
Token: 36	3476	wmic.exe
Token: SeIncreaseQuotaPrivilege	3476	wmic.exe
Token: SeSecurityPrivilege	3476	wmic.exe
Token: SeTakeOwnershipPrivilege	3476	wmic.exe
Token: SeLoadDriverPrivilege	3476	wmic.exe
Token: SeSystemProfilePrivilege	3476	wmic.exe
Token: SeSystemtimePrivilege	3476	wmic.exe
Token: SeProfSingleProcessPrivilege	3476	wmic.exe
Token: SeIncBasePriorityPrivilege	3476	wmic.exe
Token: SeCreatePagefilePrivilege	3476	wmic.exe
Token: SeBackupPrivilege	3476	wmic.exe
Token: SeRestorePrivilege	3476	wmic.exe
Token: SeShutdownPrivilege	3476	wmic.exe
Token: SeDebugPrivilege	3476	wmic.exe
Token: SeSystemEnvironmentPrivilege	3476	wmic.exe
Token: SeRemoteShutdownPrivilege	3476	wmic.exe
Token: SeUndockPrivilege	3476	wmic.exe
Token: SeManageVolumePrivilege	3476	wmic.exe
Token: 33	3476	wmic.exe
Token: 34	3476	wmic.exe
Token: 35	3476	wmic.exe
Token: 36	3476	wmic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3612	7zFM.exe
3612	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3476	4808	b5uEJHZB6Rl.exe	88
PID 4808 wrote to memory of 3476	4808	b5uEJHZB6Rl.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Krampus.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3168

C:\Users\Admin\Desktop\Krampus\b5uEJHZB6Rl.exe
"C:\Users\Admin\Desktop\Krampus\b5uEJHZB6Rl.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Krampus\krampusexec-65cafadfc556c.txt
1⤵
PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Krampus\b5uEJHZB6Rl.exe

Filesize
231KB

MD5
438289fb9c72ed39bf5497f9af21ec7a

SHA1
8120391ecb41ed6a4c6ef0b259776e59311d6997

SHA256
ea4cb7c7b4cfb2fcc04d1c3f96b20c26638e69a97b15cae14659f0d6afb78f85

SHA512
3647907fa2d503a242ef07cb20b081444b75e0c618a91232c8e77903b4b6aa823b8a7cbe07a45e02591fe48fdd23b5eae88565006b85863c0a5f6e42d7589fe0

Download Submit
C:\Users\Admin\Desktop\Krampus\krampusexec-65cafadfc556c.txt

Filesize
398B

MD5
a1a8eeadd309b1167d848222712ad8fe

SHA1
70267e1f57a5c60919ca8014a160b0815f771707

SHA256
e78865cb4a3c803ff4d54491e6f38505bfcb13450b5ec053f09e07bc77a73ce5

SHA512
310833ec3d56979bfcabc5b41963671df0815ae2efd1dff9983e97246810e795a2938dbeb2793a15ffd6a35255564cd4adbda97dd3e36d7ecf30b61b558d2475

Download Submit
memory/4808-6-0x00007FF919D63000-0x00007FF919D65000-memory.dmp

Filesize
8KB

Download
memory/4808-7-0x000001AB43970000-0x000001AB439B0000-memory.dmp

Filesize
256KB

Download
memory/4808-8-0x00007FF919D60000-0x00007FF91A822000-memory.dmp

Filesize
10.8MB

Download
memory/4808-10-0x00007FF919D60000-0x00007FF91A822000-memory.dmp

Filesize
10.8MB

Download