Analysis
-
max time kernel
88s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2025, 17:15
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
229KB
-
MD5
5444f7a053eeaaa3c692956387aa3103
-
SHA1
2a93270e874dff5f0490ab00affa8b004e08690b
-
SHA256
71cd23078dcdf0969521dae9d9a9dd51b4a266b3fb74b709126d778e345497c1
-
SHA512
14c214c4911a67d5330493a657f1033305bbd6c94f8ca6f13c0a1f1da6eb55ab7c5f3423dabcdcdcb7e3592e9149190f35667cfb4369f8325f079b97cfe946cc
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4zSa9uMzvEJlwOffuIbb8e1maETi:voZtL+EP8zSa9uMzvEJlwOffuaf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/1980-1-0x000002F3423C0000-0x000002F342400000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1980 Umbral.exe Token: SeIncreaseQuotaPrivilege 352 wmic.exe Token: SeSecurityPrivilege 352 wmic.exe Token: SeTakeOwnershipPrivilege 352 wmic.exe Token: SeLoadDriverPrivilege 352 wmic.exe Token: SeSystemProfilePrivilege 352 wmic.exe Token: SeSystemtimePrivilege 352 wmic.exe Token: SeProfSingleProcessPrivilege 352 wmic.exe Token: SeIncBasePriorityPrivilege 352 wmic.exe Token: SeCreatePagefilePrivilege 352 wmic.exe Token: SeBackupPrivilege 352 wmic.exe Token: SeRestorePrivilege 352 wmic.exe Token: SeShutdownPrivilege 352 wmic.exe Token: SeDebugPrivilege 352 wmic.exe Token: SeSystemEnvironmentPrivilege 352 wmic.exe Token: SeRemoteShutdownPrivilege 352 wmic.exe Token: SeUndockPrivilege 352 wmic.exe Token: SeManageVolumePrivilege 352 wmic.exe Token: 33 352 wmic.exe Token: 34 352 wmic.exe Token: 35 352 wmic.exe Token: 36 352 wmic.exe Token: SeIncreaseQuotaPrivilege 352 wmic.exe Token: SeSecurityPrivilege 352 wmic.exe Token: SeTakeOwnershipPrivilege 352 wmic.exe Token: SeLoadDriverPrivilege 352 wmic.exe Token: SeSystemProfilePrivilege 352 wmic.exe Token: SeSystemtimePrivilege 352 wmic.exe Token: SeProfSingleProcessPrivilege 352 wmic.exe Token: SeIncBasePriorityPrivilege 352 wmic.exe Token: SeCreatePagefilePrivilege 352 wmic.exe Token: SeBackupPrivilege 352 wmic.exe Token: SeRestorePrivilege 352 wmic.exe Token: SeShutdownPrivilege 352 wmic.exe Token: SeDebugPrivilege 352 wmic.exe Token: SeSystemEnvironmentPrivilege 352 wmic.exe Token: SeRemoteShutdownPrivilege 352 wmic.exe Token: SeUndockPrivilege 352 wmic.exe Token: SeManageVolumePrivilege 352 wmic.exe Token: 33 352 wmic.exe Token: 34 352 wmic.exe Token: 35 352 wmic.exe Token: 36 352 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1980 wrote to memory of 352 1980 Umbral.exe 90 PID 1980 wrote to memory of 352 1980 Umbral.exe 90