Behavioral task
behavioral1
Sample
e0310128f52613f4c4d92709888560dcfc9fd5d6501e1bd75b1c5ed3646cf8c0.exe
Resource
win7-20241010-en
General
-
Target
e0310128f52613f4c4d92709888560dcfc9fd5d6501e1bd75b1c5ed3646cf8c0.exe
-
Size
266KB
-
MD5
1207c1981b07615b9c02fb400030fa04
-
SHA1
02abf488720b4bd450fedc5a34ed59f66d8e73e8
-
SHA256
e0310128f52613f4c4d92709888560dcfc9fd5d6501e1bd75b1c5ed3646cf8c0
-
SHA512
4051b8d7f9c36e03141afb3c573fb3525a33238fd6ddb8085c78e31fe89b6f0ffbb77e54c5d21bc404bb1f69e3cf8280eb6d42196d84ee80e4dfd07b8eca3b0b
-
SSDEEP
6144:HloZMLrIkd8g+EtXHkv/iD4LEXrfPlO2Zic1niinT4Xb8e1mfi/eYk:FoZ0L+EP8LQrfPlO2Zic1niinTqh/Zk
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1334918270951751742/ykbIeRIpFV4Px7Tfz8ZJbhs4zhUhLmHPwyt3wHsYxrJVNpFb643KDrwkegj27iGah8Yg
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0310128f52613f4c4d92709888560dcfc9fd5d6501e1bd75b1c5ed3646cf8c0.exe
Files
-
e0310128f52613f4c4d92709888560dcfc9fd5d6501e1bd75b1c5ed3646cf8c0.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ