Extracted

• • Target
    mstl3nui2.exe
  • Size 227KB
  • SHA256 1eb53c8549fc2c54c7c45efd3770610ad8d561129fe26bfda72cfd7b5a938927
  • MD5 04c88584484639110cad8bf2719e189b
  • SHA1 65c5f0b2f133aeb3ecc3d8c64a2516299c7e7653
  • SHA512 5523371c0d65b1b98d1d35d76f55dc4e66b961b352662bae6cfc099e1e718042f93eb3c5f7f84d7101c19f8a70afaf82fbf7568268bd6971b17a78fb2fce054e
  • SSDEEP 6144:+loZMTfsXtioRkts/cnnK6cMlh46ArRiK1jwBzOursqb8e1mFi:ooZRtlRk83Mlh46ArRiK1jwBzOurH/
  • TLSH
    T149346B4933B88B17E26F9BBDD5B0548F87B1F143E90AF78E0C8895F82411B42E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionumbralspywarestealeradwarepersistence

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2