umbral | 6103369dbef89de42e49fce61b2df15524abf159ca05af0d898747f5b93cf89b | Triage

Analysis

max time kernel
3s
max time network
4s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-02-2025 07:17

Sharing

Report Analysis Logs

General

Target

CustomFemboyExecV.8.exe
Size

250KB
MD5

6b98ad29e54ae9d42c0df9a93d6c8096
SHA1

1ded43a88254b7c9de6c96267a3f8be54eeded85
SHA256

6103369dbef89de42e49fce61b2df15524abf159ca05af0d898747f5b93cf89b
SHA512

c29b74750b138e21c5e2f369433909e8c56b48096afddcaca846266ee7f4353f15ee409ad1f9a44efc72048fb14f172dd603391bd9b6cce74956e950bfda96c3
SSDEEP

6144:cloZM+rIkd8g+EtXHkv/iD4oHgtxdi8e1mA8iU:6oZtL+EP8IwxmpV

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/2912-1-0x0000000000160000-0x00000000001A6000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	CustomFemboyExecV.8.exe

C:\Users\Admin\AppData\Local\Temp\CustomFemboyExecV.8.exe
"C:\Users\Admin\AppData\Local\Temp\CustomFemboyExecV.8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x000007FEF5583000-0x000007FEF5584000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000000160000-0x00000000001A6000-memory.dmp

Filesize
280KB

Download
memory/2912-2-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download