umbral | ec9fa98b9c0a55ad5d3b51bf6148b6e2041d1a14c36b4ad98caa9438bc3854e9

Analysis

max time kernel
103s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a.exe
Size

246KB
MD5

34498c04705f269e79dd09c555ffd2a4
SHA1

744d9cdaaf4033b944563fb79800c8ddeffffeab
SHA256

fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a
SHA512

fd3f4f296d62376f08a1ce9dc8b4baefe03334edc2d55633fe8016cf0e90e067a7b6949e73605e102aa22f389da96ef8e8c1589f521583173d28fdd195e0a3a2
SSDEEP

6144:2loZMKrIkd8g+EtXHkv/iD44Uysn9GuBD0dP6aPahb8e1mJchi3:AoZRL+EP84Uysn9GuBD0dP6aPW+c43

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/5772-1-0x0000022DB2630000-0x0000022DB2674000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5772	fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a.exe
Token: SeIncreaseQuotaPrivilege	3920	wmic.exe
Token: SeSecurityPrivilege	3920	wmic.exe
Token: SeTakeOwnershipPrivilege	3920	wmic.exe
Token: SeLoadDriverPrivilege	3920	wmic.exe
Token: SeSystemProfilePrivilege	3920	wmic.exe
Token: SeSystemtimePrivilege	3920	wmic.exe
Token: SeProfSingleProcessPrivilege	3920	wmic.exe
Token: SeIncBasePriorityPrivilege	3920	wmic.exe
Token: SeCreatePagefilePrivilege	3920	wmic.exe
Token: SeBackupPrivilege	3920	wmic.exe
Token: SeRestorePrivilege	3920	wmic.exe
Token: SeShutdownPrivilege	3920	wmic.exe
Token: SeDebugPrivilege	3920	wmic.exe
Token: SeSystemEnvironmentPrivilege	3920	wmic.exe
Token: SeRemoteShutdownPrivilege	3920	wmic.exe
Token: SeUndockPrivilege	3920	wmic.exe
Token: SeManageVolumePrivilege	3920	wmic.exe
Token: 33	3920	wmic.exe
Token: 34	3920	wmic.exe
Token: 35	3920	wmic.exe
Token: 36	3920	wmic.exe
Token: SeIncreaseQuotaPrivilege	3920	wmic.exe
Token: SeSecurityPrivilege	3920	wmic.exe
Token: SeTakeOwnershipPrivilege	3920	wmic.exe
Token: SeLoadDriverPrivilege	3920	wmic.exe
Token: SeSystemProfilePrivilege	3920	wmic.exe
Token: SeSystemtimePrivilege	3920	wmic.exe
Token: SeProfSingleProcessPrivilege	3920	wmic.exe
Token: SeIncBasePriorityPrivilege	3920	wmic.exe
Token: SeCreatePagefilePrivilege	3920	wmic.exe
Token: SeBackupPrivilege	3920	wmic.exe
Token: SeRestorePrivilege	3920	wmic.exe
Token: SeShutdownPrivilege	3920	wmic.exe
Token: SeDebugPrivilege	3920	wmic.exe
Token: SeSystemEnvironmentPrivilege	3920	wmic.exe
Token: SeRemoteShutdownPrivilege	3920	wmic.exe
Token: SeUndockPrivilege	3920	wmic.exe
Token: SeManageVolumePrivilege	3920	wmic.exe
Token: 33	3920	wmic.exe
Token: 34	3920	wmic.exe
Token: 35	3920	wmic.exe
Token: 36	3920	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 3920	5772	fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a.exe	88
PID 5772 wrote to memory of 3920	5772	fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a.exe	88

C:\Users\Admin\AppData\Local\Temp\fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a.exe
"C:\Users\Admin\AppData\Local\Temp\fe25de503f5fa57842d11d2180a935855b8f89b23fd6fa95ff10272cee5f305a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5772-0-0x00007FFEDE413000-0x00007FFEDE415000-memory.dmp

Filesize
8KB

Download
memory/5772-1-0x0000022DB2630000-0x0000022DB2674000-memory.dmp

Filesize
272KB

Download
memory/5772-2-0x00007FFEDE410000-0x00007FFEDEED1000-memory.dmp

Filesize
10.8MB

Download
memory/5772-4-0x00007FFEDE410000-0x00007FFEDEED1000-memory.dmp

Filesize
10.8MB

Download