Extracted

• • Target
    Umbra2l.exe
  • Size 227KB
  • SHA256 45becab0dd1f7d861ffa7a3711f7384ad6d4699e46f2fec4fb71502cfd95ecc5
  • MD5 ff35593b6dd6fa14e1a404bbdf6b42b0
  • SHA1 386755eeda5ceae274e1d0a60796652919a5cd0b
  • SHA512 cddddfd14eba407e4782c684eb7c1a3d5ae2f13560bc704e2a48620ede5a4012a70b984f0de7d06ea9226216e3e4a089975e956ea8b29bc0c815a43401c77b54
  • SSDEEP 6144:+loZMQfsXtioRkts/cnnK6cMlhu//+8D/0TVA+Pv+bT0b8e1mli:ooZItlRk83Mlhu//+8D/0TVA+Pv+Ur
  • TLSH
    T19A346B4933B88F17E25F9BBDD5B0548F87B1F143E90AF78E0C8895E82412B42E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealerpersistenceransomware

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2