umbral | vexhook[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vexhook.exe
Size 7.7MB
Sample260508-1lay3aew9s
SHA256 d6bb2a6f3df3b72a9f27eb855ad6e34c4991dc849f6c098f49a78ae4ed0ea263
MD5 e8b496daa427757c5785a1820b387f10
SHA1 162cdd77b4429b27f5d96a7ac66b3d5cc444d887
SHA512 e49bc4c4ffa3c890d1f30a0f61dcee4fcf75a61710994897a2b0c1402a7d3265f26e31b3d87dc171a44f22434c8d5dafc37a5e69b9605aab85a8bacbf07a553e
SSDEEP 196608:nTblT/ZTqGWCYj/FsQ/vtc/aBYHEoVk9Bi+K7XQS:TblTh9WT9/vtcBHEoVk9037XQS
TLSH
T1E486E002F202C144E456DD798E52E996E7313848AF1657EB3284BF1E2EF73C1AEB6741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer umbral

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 1 IoCs

resource	yara_rule
sample	family_umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vexhook.exe

File Explorer

vexhook.exe

.exe 7.7MB

vexhook.exe

IMPHASH 52055e8e1e8ac168cb08b81bc2befe22
SHA256 d6bb2a6f3df3b72a9f27eb855ad6e34c4991dc849f6c098f49a78ae4ed0ea263
MD5 e8b496daa427757c5785a1820b387f10
SHA1 162cdd77b4429b27f5d96a7ac66b3d5cc444d887
SHA512 e49bc4c4ffa3c890d1f30a0f61dcee4fcf75a61710994897a2b0c1402a7d3265f26e31b3d87dc171a44f22434c8d5dafc37a5e69b9605aab85a8bacbf07a553e
SSDEEP 196608:nTblT/ZTqGWCYj/FsQ/vtc/aBYHEoVk9Bi+K7XQS:TblTh9WT9/vtcBHEoVk9037XQS
TLSH
T1E486E002F202C144E456DD798E52E996E7313848AF1657EB3284BF1E2EF73C1AEB6741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Umbral payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1455576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleFileNameA LoadLibraryExA GetLastError FormatMessageA GetTickCount64 SetThreadPriority GetCurrentThread GetCurrentThreadId CreateDirectoryA VirtualAllocEx GetConsoleScreenBufferInfo SetConsoleTitleA GetCurrentProcess GetStdHandle SetConsoleMode GetConsoleMode SetFileAttributesA GetLocalTime GetModuleHandleW GetConsoleWindow CreateProcessA GetComputerNameA Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next SetPriorityClass K32GetProcessMemoryInfo SetProcessWorkingSetSize LocalFree GetTempPathA CreateDirectoryW CreateFileW Sleep QueryPerformanceFrequency QueryPerformanceCounter FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead LoadLibraryA MultiByteToWideChar GlobalAlloc FreeLibrary VerSetConditionMask FindFirstFileExW GetProcAddress GetModuleHandleA GetCurrentProcessId WriteFile CloseHandle DeleteFileA FindFirstFileW CreateFileA FindClose

user32

EmptyClipboard GetClipboardData ShowCursor ReleaseDC CloseClipboard ShowWindow UpdateWindow RegisterClassExA PostQuitMessage UnregisterClassA MonitorFromPoint DispatchMessageA OpenClipboard GetAsyncKeyState GetSystemMetrics SendInput GetCursorPos GetWindowRect DestroyWindow IsWindowVisible IsWindow SetWindowLongA PeekMessageA SetClipboardData TranslateMessage BringWindowToTop SetLayeredWindowAttributes CreateWindowExA DefWindowProcA SetWindowDisplayAffinity CreateCursor MessageBoxA FindWindowW GetKeyState GetMessageExtraInfo LoadCursorA GetWindowLongPtrA GetDC GetDesktopWindow MonitorFromWindow ScreenToClient GetParent GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetWindowPos SetCapture SetWindowLongPtrA SetForegroundWindow SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos

gdi32

GetDeviceCaps

comdlg32

GetOpenFileNameA

advapi32

OpenProcessToken GetTokenInformation

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteExA

ole32

CoInitializeEx CoCreateInstance

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z _Query_perf_frequency ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Thrd_id _Query_perf_counter _Xtime_get_ticks _Thrd_join _Cnd_broadcast ?_Random_device@std@@YAIXZ _Thrd_yield ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

ws2_32

WSACleanup getaddrinfo WSAStartup gethostname inet_ntop freeaddrinfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr memmove __intrinsic_setjmp __std_exception_destroy __std_exception_copy __std_terminate __current_exception_context _CxxThrowException __current_exception __C_specific_handler memset memcpy memchr memcmp _purecall strrchr longjmp strchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit abort _register_onexit_function strerror _cexit _errno terminate _invoke_watson _initialize_onexit_table _initialize_narrow_environment _beginthreadex _configure_narrow_argv exit

api-ms-win-crt-math-l1-1-0

_fdclass acos acosf asin asinf atan frexp atan2 atan2f ceil ceilf cos cosf cosh exp expf floor floorf fmod cbrt fmodf log log10 lroundf round fminf nearbyint logf pow tan powf roundf sin sinf ldexp tanh sqrtf sqrt sinh __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsnprintf_s freopen __stdio_common_vsprintf _get_stream_buffer_pointers fsetpos fgetpos fgetc fputc ferror fopen getc _wfopen feof fwrite fread fgets __p__commode tmpnam _set_fmode ftell __acrt_iob_func fflush fclose fseek __stdio_common_vsprintf_s clearerr __stdio_common_vfprintf _fseeki64 _ftelli64 _pclose ungetc _popen setvbuf tmpfile

api-ms-win-crt-string-l1-1-0

isspace strpbrk strcpy_s isgraph isdigit strspn isalnum toupper isupper isalpha iscntrl ispunct islower strcoll strncpy_s strncmp strnlen _stricmp strcmp isxdigit tolower strncpy

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-convert-l1-1-0

strtof strtol strtod strtoul atof strtoull

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func setlocale localeconv

api-ms-win-crt-time-l1-1-0

_time64 _difftime64 clock _mktime64 strftime _gmtime64 _localtime64 _localtime64_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file rename _unlock_file remove