Behavioral task
behavioral1
Sample
0eec8833aa50f5222085d4febcf70d570fc9cdf769fde33661c3c5f274533313.exe
Resource
win7-20240903-en
General
-
Target
0eec8833aa50f5222085d4febcf70d570fc9cdf769fde33661c3c5f274533313
-
Size
229KB
-
MD5
28dd22fab069769c895b3c902035b2a6
-
SHA1
90577e0d058c8cc553f11a56f0f6202bd614e471
-
SHA256
0eec8833aa50f5222085d4febcf70d570fc9cdf769fde33661c3c5f274533313
-
SHA512
a15a3979f708a5363851e66b199f787991fd512b58d314b9d601cb11e0bb8bc5a140b5835971dbc12f288137adf30f7e74c500064e785981b2d20c2d2e4bc74c
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4/LI6BPUonKWvRsY9O3b8e1moAi:noZtL+EP8/LI6BPUonKWvRsY9M5Z
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1340764748391645225/uULT2sea9sIpCjgKKmBDah2Uj1_awysvvvG_UhFArY5rDSSew6dNx6W97h1CwsgLRWO1
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0eec8833aa50f5222085d4febcf70d570fc9cdf769fde33661c3c5f274533313
Files
-
0eec8833aa50f5222085d4febcf70d570fc9cdf769fde33661c3c5f274533313.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ