umbral | 894a461e0d709023ba6ec45f748b38a79ae12cf398702244ef2ffa93dd644133

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aad3df12348dcf9b2bd4c1b1f7cba937.exe
Size

227KB
MD5

aad3df12348dcf9b2bd4c1b1f7cba937
SHA1

98e781980a89d77cfbd266e98de28c3a88c04b66
SHA256

bada765d60e5c646ce6286023fb474c9136c4d31c33f2d1efb08b831c08e29c9
SHA512

5636ed03df0561b9e769e3e0191ff9344e56c28a14007c734fea9f53d739b18ce3dbd3261e6b505dbd235871273fa7cabe5b6d798e5eed6361f0e5a5209a9dc7
SSDEEP

6144:+loZMrrIkd8g+EtXHkv/iD4J1nsPlO2ZEc1niinz+b8e1mpii:ooZUL+EP8J1nsPlO2ZEc1niinWs3

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/2888-1-0x00000000012A0000-0x00000000012E0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	aad3df12348dcf9b2bd4c1b1f7cba937.exe
Token: SeIncreaseQuotaPrivilege	3012	wmic.exe
Token: SeSecurityPrivilege	3012	wmic.exe
Token: SeTakeOwnershipPrivilege	3012	wmic.exe
Token: SeLoadDriverPrivilege	3012	wmic.exe
Token: SeSystemProfilePrivilege	3012	wmic.exe
Token: SeSystemtimePrivilege	3012	wmic.exe
Token: SeProfSingleProcessPrivilege	3012	wmic.exe
Token: SeIncBasePriorityPrivilege	3012	wmic.exe
Token: SeCreatePagefilePrivilege	3012	wmic.exe
Token: SeBackupPrivilege	3012	wmic.exe
Token: SeRestorePrivilege	3012	wmic.exe
Token: SeShutdownPrivilege	3012	wmic.exe
Token: SeDebugPrivilege	3012	wmic.exe
Token: SeSystemEnvironmentPrivilege	3012	wmic.exe
Token: SeRemoteShutdownPrivilege	3012	wmic.exe
Token: SeUndockPrivilege	3012	wmic.exe
Token: SeManageVolumePrivilege	3012	wmic.exe
Token: 33	3012	wmic.exe
Token: 34	3012	wmic.exe
Token: 35	3012	wmic.exe
Token: SeIncreaseQuotaPrivilege	3012	wmic.exe
Token: SeSecurityPrivilege	3012	wmic.exe
Token: SeTakeOwnershipPrivilege	3012	wmic.exe
Token: SeLoadDriverPrivilege	3012	wmic.exe
Token: SeSystemProfilePrivilege	3012	wmic.exe
Token: SeSystemtimePrivilege	3012	wmic.exe
Token: SeProfSingleProcessPrivilege	3012	wmic.exe
Token: SeIncBasePriorityPrivilege	3012	wmic.exe
Token: SeCreatePagefilePrivilege	3012	wmic.exe
Token: SeBackupPrivilege	3012	wmic.exe
Token: SeRestorePrivilege	3012	wmic.exe
Token: SeShutdownPrivilege	3012	wmic.exe
Token: SeDebugPrivilege	3012	wmic.exe
Token: SeSystemEnvironmentPrivilege	3012	wmic.exe
Token: SeRemoteShutdownPrivilege	3012	wmic.exe
Token: SeUndockPrivilege	3012	wmic.exe
Token: SeManageVolumePrivilege	3012	wmic.exe
Token: 33	3012	wmic.exe
Token: 34	3012	wmic.exe
Token: 35	3012	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3012	2888	aad3df12348dcf9b2bd4c1b1f7cba937.exe	30
PID 2888 wrote to memory of 3012	2888	aad3df12348dcf9b2bd4c1b1f7cba937.exe	30
PID 2888 wrote to memory of 3012	2888	aad3df12348dcf9b2bd4c1b1f7cba937.exe	30

C:\Users\Admin\AppData\Local\Temp\aad3df12348dcf9b2bd4c1b1f7cba937.exe
"C:\Users\Admin\AppData\Local\Temp\aad3df12348dcf9b2bd4c1b1f7cba937.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x00000000012A0000-0x00000000012E0000-memory.dmp

Filesize
256KB

Download
memory/2888-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-3-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download