Analysis
-
max time kernel
403s -
max time network
404s -
platform
windows11-21h2_x64 -
resource
win11-20250211-en -
resource tags
arch:x64arch:x86image:win11-20250211-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-02-2025 23:49
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
fd99541be9d7e3690c02aacc9b25fb64
-
SHA1
d1031c9cfde65a08f2682727dab72fd0373bbaa7
-
SHA256
d9f33d5d2633fbb0038ee965a140a7a26e2f28b10aee8b3ea0e729452128d19c
-
SHA512
d2a8cb3d82874475ee955831e952834b4626ed0a0931f76ee38a910295aacb39e4e6da60598df1335e840685ece7d8394e3b64272f5172ceecd78d257b944245
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD4DMw2KInDAPZMK7bCR9b8e1mogi:foZtL+EP8DMw2KInDAPZMK7bCnz5
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/636-1-0x000001C0FE390000-0x000001C0FE3D0000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 636 Umbral.exe Token: SeIncreaseQuotaPrivilege 1632 wmic.exe Token: SeSecurityPrivilege 1632 wmic.exe Token: SeTakeOwnershipPrivilege 1632 wmic.exe Token: SeLoadDriverPrivilege 1632 wmic.exe Token: SeSystemProfilePrivilege 1632 wmic.exe Token: SeSystemtimePrivilege 1632 wmic.exe Token: SeProfSingleProcessPrivilege 1632 wmic.exe Token: SeIncBasePriorityPrivilege 1632 wmic.exe Token: SeCreatePagefilePrivilege 1632 wmic.exe Token: SeBackupPrivilege 1632 wmic.exe Token: SeRestorePrivilege 1632 wmic.exe Token: SeShutdownPrivilege 1632 wmic.exe Token: SeDebugPrivilege 1632 wmic.exe Token: SeSystemEnvironmentPrivilege 1632 wmic.exe Token: SeRemoteShutdownPrivilege 1632 wmic.exe Token: SeUndockPrivilege 1632 wmic.exe Token: SeManageVolumePrivilege 1632 wmic.exe Token: 33 1632 wmic.exe Token: 34 1632 wmic.exe Token: 35 1632 wmic.exe Token: 36 1632 wmic.exe Token: SeIncreaseQuotaPrivilege 1632 wmic.exe Token: SeSecurityPrivilege 1632 wmic.exe Token: SeTakeOwnershipPrivilege 1632 wmic.exe Token: SeLoadDriverPrivilege 1632 wmic.exe Token: SeSystemProfilePrivilege 1632 wmic.exe Token: SeSystemtimePrivilege 1632 wmic.exe Token: SeProfSingleProcessPrivilege 1632 wmic.exe Token: SeIncBasePriorityPrivilege 1632 wmic.exe Token: SeCreatePagefilePrivilege 1632 wmic.exe Token: SeBackupPrivilege 1632 wmic.exe Token: SeRestorePrivilege 1632 wmic.exe Token: SeShutdownPrivilege 1632 wmic.exe Token: SeDebugPrivilege 1632 wmic.exe Token: SeSystemEnvironmentPrivilege 1632 wmic.exe Token: SeRemoteShutdownPrivilege 1632 wmic.exe Token: SeUndockPrivilege 1632 wmic.exe Token: SeManageVolumePrivilege 1632 wmic.exe Token: 33 1632 wmic.exe Token: 34 1632 wmic.exe Token: 35 1632 wmic.exe Token: 36 1632 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 636 wrote to memory of 1632 636 Umbral.exe 82 PID 636 wrote to memory of 1632 636 Umbral.exe 82