Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
23/03/2025, 17:14
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
5444f7a053eeaaa3c692956387aa3103
-
SHA1
2a93270e874dff5f0490ab00affa8b004e08690b
-
SHA256
71cd23078dcdf0969521dae9d9a9dd51b4a266b3fb74b709126d778e345497c1
-
SHA512
14c214c4911a67d5330493a657f1033305bbd6c94f8ca6f13c0a1f1da6eb55ab7c5f3423dabcdcdcb7e3592e9149190f35667cfb4369f8325f079b97cfe946cc
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4zSa9uMzvEJlwOffuIbb8e1maETi:voZtL+EP8zSa9uMzvEJlwOffuaf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2952-1-0x0000000001280000-0x00000000012C0000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2952 Umbral.exe Token: SeIncreaseQuotaPrivilege 984 wmic.exe Token: SeSecurityPrivilege 984 wmic.exe Token: SeTakeOwnershipPrivilege 984 wmic.exe Token: SeLoadDriverPrivilege 984 wmic.exe Token: SeSystemProfilePrivilege 984 wmic.exe Token: SeSystemtimePrivilege 984 wmic.exe Token: SeProfSingleProcessPrivilege 984 wmic.exe Token: SeIncBasePriorityPrivilege 984 wmic.exe Token: SeCreatePagefilePrivilege 984 wmic.exe Token: SeBackupPrivilege 984 wmic.exe Token: SeRestorePrivilege 984 wmic.exe Token: SeShutdownPrivilege 984 wmic.exe Token: SeDebugPrivilege 984 wmic.exe Token: SeSystemEnvironmentPrivilege 984 wmic.exe Token: SeRemoteShutdownPrivilege 984 wmic.exe Token: SeUndockPrivilege 984 wmic.exe Token: SeManageVolumePrivilege 984 wmic.exe Token: 33 984 wmic.exe Token: 34 984 wmic.exe Token: 35 984 wmic.exe Token: SeIncreaseQuotaPrivilege 984 wmic.exe Token: SeSecurityPrivilege 984 wmic.exe Token: SeTakeOwnershipPrivilege 984 wmic.exe Token: SeLoadDriverPrivilege 984 wmic.exe Token: SeSystemProfilePrivilege 984 wmic.exe Token: SeSystemtimePrivilege 984 wmic.exe Token: SeProfSingleProcessPrivilege 984 wmic.exe Token: SeIncBasePriorityPrivilege 984 wmic.exe Token: SeCreatePagefilePrivilege 984 wmic.exe Token: SeBackupPrivilege 984 wmic.exe Token: SeRestorePrivilege 984 wmic.exe Token: SeShutdownPrivilege 984 wmic.exe Token: SeDebugPrivilege 984 wmic.exe Token: SeSystemEnvironmentPrivilege 984 wmic.exe Token: SeRemoteShutdownPrivilege 984 wmic.exe Token: SeUndockPrivilege 984 wmic.exe Token: SeManageVolumePrivilege 984 wmic.exe Token: 33 984 wmic.exe Token: 34 984 wmic.exe Token: 35 984 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2952 wrote to memory of 984 2952 Umbral.exe 31 PID 2952 wrote to memory of 984 2952 Umbral.exe 31 PID 2952 wrote to memory of 984 2952 Umbral.exe 31