umbral | 525209de288e36bab56d3a19446249ffd067c8757b5d5870daa6a782b9567e74

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Target

6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b.exe
Size

401KB
MD5

5caa4902ecea464d3d96da57af2945bd
SHA1

530d15e868487a82c345e9dda60e5465894834c0
SHA256

6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b
SHA512

f4370bd4c9d4909099427ddbf9b500d65c701289040a16dd56e1cb79a8407bff86b22d566c94adc01f24773edc2b26dcd21bd8f64cde32e19b79f8bf36d49259
SSDEEP

6144:FsEM9IugZckJLDWVAUGk3WMg/NpM3/2X0cIQL3nUt+xa98beFqLAjk04:3LDWebk3WMsNpM3/26QL32wOqL70

Score

10^/10

umbral stealer

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral3/memory/2628-1-0x0000000001100000-0x000000000116A000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2084	2628	6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b.exe	30
PID 2628 wrote to memory of 2084	2628	6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b.exe	30
PID 2628 wrote to memory of 2084	2628	6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b.exe	30

C:\Users\Admin\AppData\Local\Temp\6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b.exe
"C:\Users\Admin\AppData\Local\Temp\6b6755ca1bb4486fb7501572a580e96343181ff957605ea150f7d94beabef27b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2628 -s 604
  2⤵
  PID:2084

memory/2628-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/2628-1-0x0000000001100000-0x000000000116A000-memory.dmp

Filesize
424KB

Download
memory/2628-2-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2628-3-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download