Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 08:22
General
-
Target
Umbral.exe
-
Size
230KB
-
MD5
cd32fdd05be451dcebaa04ed226b417d
-
SHA1
2ee53c0439df3d1d490df3ae4ae392d1b3bdde4f
-
SHA256
f255a381ef85b1da243ce96a36362bf08fe313ff0666e58e40430bbbd365e3f3
-
SHA512
b76af4ff2da8a31dda4b8d32b5eec349862f1b1c75d8806f4dbbbe46e7de899162cd5f79d857766fb934b8ad56f1e9b6e836cba78d1e9f0374d0fc97568e65e4
-
SSDEEP
6144:1loZM+rIkd8g+EtXHkv/iD4IbGlW0b3cwNImHHm4ib8e1mbi:XoZtL+EP8IbGlW0b3cwNImHHm/R
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4736-1-0x00000247D5B80000-0x00000247D5BC0000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4736 Umbral.exe Token: SeIncreaseQuotaPrivilege 8 wmic.exe Token: SeSecurityPrivilege 8 wmic.exe Token: SeTakeOwnershipPrivilege 8 wmic.exe Token: SeLoadDriverPrivilege 8 wmic.exe Token: SeSystemProfilePrivilege 8 wmic.exe Token: SeSystemtimePrivilege 8 wmic.exe Token: SeProfSingleProcessPrivilege 8 wmic.exe Token: SeIncBasePriorityPrivilege 8 wmic.exe Token: SeCreatePagefilePrivilege 8 wmic.exe Token: SeBackupPrivilege 8 wmic.exe Token: SeRestorePrivilege 8 wmic.exe Token: SeShutdownPrivilege 8 wmic.exe Token: SeDebugPrivilege 8 wmic.exe Token: SeSystemEnvironmentPrivilege 8 wmic.exe Token: SeRemoteShutdownPrivilege 8 wmic.exe Token: SeUndockPrivilege 8 wmic.exe Token: SeManageVolumePrivilege 8 wmic.exe Token: 33 8 wmic.exe Token: 34 8 wmic.exe Token: 35 8 wmic.exe Token: 36 8 wmic.exe Token: SeIncreaseQuotaPrivilege 8 wmic.exe Token: SeSecurityPrivilege 8 wmic.exe Token: SeTakeOwnershipPrivilege 8 wmic.exe Token: SeLoadDriverPrivilege 8 wmic.exe Token: SeSystemProfilePrivilege 8 wmic.exe Token: SeSystemtimePrivilege 8 wmic.exe Token: SeProfSingleProcessPrivilege 8 wmic.exe Token: SeIncBasePriorityPrivilege 8 wmic.exe Token: SeCreatePagefilePrivilege 8 wmic.exe Token: SeBackupPrivilege 8 wmic.exe Token: SeRestorePrivilege 8 wmic.exe Token: SeShutdownPrivilege 8 wmic.exe Token: SeDebugPrivilege 8 wmic.exe Token: SeSystemEnvironmentPrivilege 8 wmic.exe Token: SeRemoteShutdownPrivilege 8 wmic.exe Token: SeUndockPrivilege 8 wmic.exe Token: SeManageVolumePrivilege 8 wmic.exe Token: 33 8 wmic.exe Token: 34 8 wmic.exe Token: 35 8 wmic.exe Token: 36 8 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4736 wrote to memory of 8 4736 Umbral.exe 82 PID 4736 wrote to memory of 8 4736 Umbral.exe 82