Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/03/2025, 17:15
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
5444f7a053eeaaa3c692956387aa3103
-
SHA1
2a93270e874dff5f0490ab00affa8b004e08690b
-
SHA256
71cd23078dcdf0969521dae9d9a9dd51b4a266b3fb74b709126d778e345497c1
-
SHA512
14c214c4911a67d5330493a657f1033305bbd6c94f8ca6f13c0a1f1da6eb55ab7c5f3423dabcdcdcb7e3592e9149190f35667cfb4369f8325f079b97cfe946cc
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4zSa9uMzvEJlwOffuIbb8e1maETi:voZtL+EP8zSa9uMzvEJlwOffuaf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2824-1-0x0000000000010000-0x0000000000050000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2824 Umbral.exe Token: SeIncreaseQuotaPrivilege 2556 wmic.exe Token: SeSecurityPrivilege 2556 wmic.exe Token: SeTakeOwnershipPrivilege 2556 wmic.exe Token: SeLoadDriverPrivilege 2556 wmic.exe Token: SeSystemProfilePrivilege 2556 wmic.exe Token: SeSystemtimePrivilege 2556 wmic.exe Token: SeProfSingleProcessPrivilege 2556 wmic.exe Token: SeIncBasePriorityPrivilege 2556 wmic.exe Token: SeCreatePagefilePrivilege 2556 wmic.exe Token: SeBackupPrivilege 2556 wmic.exe Token: SeRestorePrivilege 2556 wmic.exe Token: SeShutdownPrivilege 2556 wmic.exe Token: SeDebugPrivilege 2556 wmic.exe Token: SeSystemEnvironmentPrivilege 2556 wmic.exe Token: SeRemoteShutdownPrivilege 2556 wmic.exe Token: SeUndockPrivilege 2556 wmic.exe Token: SeManageVolumePrivilege 2556 wmic.exe Token: 33 2556 wmic.exe Token: 34 2556 wmic.exe Token: 35 2556 wmic.exe Token: SeIncreaseQuotaPrivilege 2556 wmic.exe Token: SeSecurityPrivilege 2556 wmic.exe Token: SeTakeOwnershipPrivilege 2556 wmic.exe Token: SeLoadDriverPrivilege 2556 wmic.exe Token: SeSystemProfilePrivilege 2556 wmic.exe Token: SeSystemtimePrivilege 2556 wmic.exe Token: SeProfSingleProcessPrivilege 2556 wmic.exe Token: SeIncBasePriorityPrivilege 2556 wmic.exe Token: SeCreatePagefilePrivilege 2556 wmic.exe Token: SeBackupPrivilege 2556 wmic.exe Token: SeRestorePrivilege 2556 wmic.exe Token: SeShutdownPrivilege 2556 wmic.exe Token: SeDebugPrivilege 2556 wmic.exe Token: SeSystemEnvironmentPrivilege 2556 wmic.exe Token: SeRemoteShutdownPrivilege 2556 wmic.exe Token: SeUndockPrivilege 2556 wmic.exe Token: SeManageVolumePrivilege 2556 wmic.exe Token: 33 2556 wmic.exe Token: 34 2556 wmic.exe Token: 35 2556 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2556 2824 Umbral.exe 30 PID 2824 wrote to memory of 2556 2824 Umbral.exe 30 PID 2824 wrote to memory of 2556 2824 Umbral.exe 30