umbral | 6ca4eb8dd9d6d0677252a890c9a97ed45b360666c89ba39d8941267eaaee1772

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.2.0-x64.rar
Size 3.7MB
Sample261109-r8bdnsgc52
SHA256 6ca4eb8dd9d6d0677252a890c9a97ed45b360666c89ba39d8941267eaaee1772
MD5 96a6208cfd4080d348e5105d71558283
SHA1 e0a6e65fcbd587786cf600c38fdf1155eb259013
SHA512 ea23c6abbe96fdaad523e978b60c9fe3ca728a848b9aada3eff95b955410932602031da943a766d594315aeec777d7c5e2da443053c504bfb40fec1c9b389d30
SSDEEP 98304:HBmcIbjB7b/J0FCKvlWbir1c6dWzC6/qWuHXHyyLbAWpZY7MwGX:nIhDJg8biri2oCzHXSFmZSQ
TLSH
T1340633701EED0C576335A058BC722BAEDCED821ACDAB2149CD630FC95769DC485DE4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1326174684118650900/77XY7JQnZZjChzZIu4k1mCsTX35cO2GPUNVEQwiagpBO6Po9fkoBknhNDlwLg24_Skkk

Targets

- Target
  Xeno-v1.2.0-x64/Install dependencies.bat
- Size 1KB
- SHA256 f545d644196419b41eadae3f0846888c396284cc148c780916c0d96a07f71b40
- MD5 eb4b04fbf3be04946d84a01ede5cbe9a
- SHA1 c03837830a409c2ef177925bd3e4ec9544cc5031
- SHA512 42dae275458e8f23383285087cda5dad95bfee58bdb86dc1b6c07373296e35f99fd3c249fe022a5bbd3e9b0a465b6231922267fb330d6b5febeb7a731d320749
- TLSH
  T11E31520D7A0D96366BF0C64382B1225CEA1F12031F5554FCB5EAD2E02B2F6D1E3F9491
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Xeno-v1.2.0-x64/Microsoft.Web.WebView2.Core.dll
- Size 557KB
- SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
- MD5 b037ca44fd19b8eedb6d5b9de3e48469
- SHA1 1f328389c62cf673b3de97e1869c139d2543494e
- SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
- SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
- TLSH
  T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Xeno-v1.2.0-x64/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
- MD5 8153423918c8cbf54b44acec01f1d6c2
- SHA1 f0c3c5412b809725e6d4809230adb15cc7d83ad2
- SHA512 f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
- SSDEEP 768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
- TLSH
  T1B4034B0483DCC617D6EB6FB8A5B491620B7ABF837960D36D1C84F5E90DB37A0891076B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Xeno-v1.2.0-x64/Microsoft.Web.WebView2.Wpf.dll
- Size 50KB
- SHA256 b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4
- MD5 4a292c5c2abf1aab91dee8eecafe0ab6
- SHA1 369e788108e5fb0608a803fa2e5a06690b4464b5
- SHA512 ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde
- SSDEEP 1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz
- TLSH
  T12E33398047AD8533D6EF4FB450B481214B79BE83B9B1E78A1DC8F4E91DA77800A543AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Xeno-v1.2.0-x64/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH
  T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Xeno-v1.2.0-x64/Xeno.dll
- Size 1.3MB
- SHA256 887ea84d65f10821d48dcb3678dc8834338d1e2e13915f6b6b02971a2fb0bcf2
- MD5 538ce914853d942471aca19f7344ee45
- SHA1 d34ea715f5ac65a61f753119ec1534dd712a37e1
- SHA512 f487a9c7cd301ecc51b8f5890e1aa223b9f4373aba3e75d71cba0e3bcbdf7032a365bd23e8ae19520bfa90962c6cd36410bb7f83f8f173b25f2ec1f87592cd03
- SSDEEP 24576:1IdKiywcIFdxMJm2yOCvDLuMyw+wwZzNggeCaGtNm1pKy:1IdKiIgpvDKMz+9ZzNgKaK41z
- TLSH
  T115557C17E65501F9C1ABC1B8DB978A17F7B27809032097EB12E5AA252F17BE18F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Xeno-v1.2.0-x64/Xeno.exe
- Size 472KB
- SHA256 0fb58ac834d40277334929065b4755d357d0f2a126517af872b22dd98a3ecda3
- MD5 3c06a6dbc1daed31fe3888fa5f43535d
- SHA1 bf507cb104e62167a3fe2cdcd61a37c4061847ce
- SHA512 14d538046a2d295facfacc7fe3897390d932332c39784a4f39a0ef4867cfdf6b29f0b952753526405f777d20b66d1d17bfb647be842bf2c10f830c5e5bb5b019
- SSDEEP 12288:NoZtL+EP8O23sNPlO2ZCc1niin30HEWoZtL+EP8O23sNPlO2ZCc1niin30HE0:bI8L3sNPlO2ZCc1niin3GI8L3sNPlO2C
- TLSH
  T120A46C5937B8CB17E25F8BBDD5B1148F87B1F143E90AF78E0C8895E82811B42E909E57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery umbral stealer
- Detects Umbral payload
- Family: Umbral
  Umbral stealer is an open-source modular stealer written in C#.
  stealer umbral
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral13 behavioral14
- Target
  Xeno-v1.2.0-x64/XenoUI.dll
- Size 95KB
- SHA256 3788b42e87c69c077868856b07c03e8606e0f49389c947231701100d99337e1c
- MD5 0c693fdf5031de28e139121866d4e71f
- SHA1 d4e3f81ce0ac00efbc537b6aa4ebc07f039aaf9a
- SHA512 4298a579eea032e794ac4aaa2e18c793fbe0d3f33a2f8e948fde510427e604f06072b71703183c9ca88c73a805627187241f47845a9f16822243388ae5cb42af
- SSDEEP 1536:gOTgjZ0JbSfMuafhOWR42zxMVY6dTPr/Wa5iiphLuM/APHV5y6SlSW8zXR:bT+WytdTPr/WAbK7Pby6S+zXR
- TLSH
  T16AA36D4137AC8B29DB7E0F7C543642951A73BE06E5A2F70E18CC74D96CF678296023A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Xeno-v1.2.0-x64/XenoUI.exe
- Size 140KB
- SHA256 326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b
- MD5 f0d6a8ef8299c5f15732a011d90b0be1
- SHA1 5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf
- SHA512 5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27
- SSDEEP 3072:2hK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxDhBury:2hK4XycqgpfCup5sVxuZ04bhA
- TLSH
  T106E31803B2A810FCE1BBA37899A21A05F3767C15477197CF0390B66A1F77AD09E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral17 behavioral18
- Target
  Xeno-v1.2.0-x64/bin/Monaco/index.html
- Size 164KB
- SHA256 f1d2c52f2803c29585b81d2eff74c56242d27e9619ee6d38081d5604c5bb1951
- MD5 001dcbb8f41cdcbf9b4d1e3a0ed4b2d2
- SHA1 982a05814546017c40771e59e7677b53d84787e9
- SHA512 9a4eba2a9314b6f5851997e1db0ecfae8e40da3443d8a5f9df933ccf6a4d75fc330888c8d14818326e15b3dec9ae2f5f7e73cd08c3822dd7eb0b2d753c8cd8fa
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblM:64J09BA3pZaFD48VOAGUWYPjdlLJbRBS
- TLSH
  T17BF3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral19 behavioral20
- Target
  Xeno-v1.2.0-x64/bin/Monaco/vs/base/worker/workerMain.js
- Size 133KB
- SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
- MD5 d0ac5294c58e523cddf25bc6d785fa48
- SHA1 1b3661b6db36f1b14fd80dc9a739bfc69c68dfe5
- SHA512 fea07a1ea5d29a3b4c614248655f4d1ddd94c10c6a6b5c8b428a8b4c0cbec7e7492fa0665c5001e65ce167240ffdfc5ac2c2ed14da3d6f508ae8d8b3c8e8eebb
- SSDEEP 3072:bzjH/zYJc5c/7tMLrJ78II4F9N8+em5W+:XjH/zYJc5c/76LrJ78I7BL
- TLSH
  T1D4D3C5CD72A5B4125397A1B1507F110FF33A296A980D44BCF365C8DD2DBA48A617BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Xeno-v1.2.0-x64/bin/Monaco/vs/basic-languages/lua/lua.js
- Size 4KB
- SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
- MD5 eebda1fdd970433750c115eae2f03865
- SHA1 3f1a1cddb99dead013eac825eb418241656d4bf0
- SHA512 8b188f3ae73a14a9318dce9761312d9dd2360ab00ee36e83ca6b74288a109c91770954db7537fd84a76707a1e79528fffc97f3a718bcd924545b469a1363c9cb
- SSDEEP 96:HDGAW6FJJJkCO8evcIWtdrvrg+1/sLMiWAOKjLobLMzD:BWCDqC20IWtZD92pzOKvomD
- TLSH
  T1CEA182C6FDCCA35E8BFAF7C4CAF1E976F58DC231C02550BAFAD05508060CA89965E625
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Xeno-v1.2.0-x64/bin/Monaco/vs/editor/editor.main.js
- Size 2.1MB
- SHA256 b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
- MD5 2dc0068cdbc03ce43a75ab0b2df664e2
- SHA1 817a209e179466dc8a14e05eb11a6c1b7e3d71eb
- SHA512 1ce29ed21e027d3552dc05162250bd62d66555f7b9ff48c9c94116d1e696089c32851533e7db30a7507a85b598df8fbf66292904c446536ccd3b2c60209d9d3d
- SSDEEP 24576:jFFExk98EXl2uRJxjP3Ddv6QLtQ2MbRpn:Yxk98EXl2ixjP3Ddv6QLtdMf
- TLSH
  T1EAA5E6997155342243C7A0F6A4BF050BB23A546DE80A506CB3B8D8ED2CFE9496377F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Xeno-v1.2.0-x64/bin/Monaco/vs/editor/editor.main.nls.de.js
- Size 46KB
- SHA256 cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
- MD5 d1fd2fb756c73970b9c5e0ba07bff708
- SHA1 470057b3244886dccc9f6074297cc8bc2a9c1b39
- SHA512 db2432182ff4c85fcca5093d0e433ed9cf5bed3ea3db9ed82fedc87af4d260e0d0f29ff67f0b8ac78e162586a74998ad082a91e8f9a76717827a83d5b2f775cf
- SSDEEP 768:ocuLC1xYdRB1a3Xq1GdigBoQqAaI/QQUEYPxFpXT1kF7bJZYmz7lehjDWMQRBk3Z:oclxgVuXq1GdiRQqAaI/QvEYPxFpDkbg
- TLSH
  T1F12308B19D46702A9FC963E0BB415D3B3A1CE2AE7A56500E4C7DC427204BAF9C6DF432
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Xeno-v1.2.0-x64/bin/Monaco/vs/editor/editor.main.nls.es.js
- Size 46KB
- SHA256 327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
- MD5 36f546b28ca17ece9f8eb9bcf8344e13
- SHA1 d43934b9041587799e332b2f568aa81666227258
- SHA512 13f8cc23038c07b6840514db4fc7b503b7a38ae1ec3baab44f1bfbded40ac50ae03c05c754f9678eecd0c8fcefab958152b39b731068b8c2c976c4c57e97f36d
- SSDEEP 768:oX8nKFyVgAYwTQG8zHqIkGMvnmvoKA9OfxjB3EVuU13pjbazPn0ANy7+IkLDKPp9:oMKFyVRcdzHqIkGMvnmvoKA9OfxjB3E5
- TLSH
  T17A23A73647CC175315D302CEF2D3D513D188AC89B068C1DBA1BA9B6560CCEECD96FA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Xeno-v1.2.0-x64/bin/Monaco/vs/editor/editor.main.nls.fr.js
- Size 49KB
- SHA256 6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
- MD5 1a29080733878dd44e0c118e84cd0c39
- SHA1 60c158e23962b11918f6cae26445fad5b63bc65a
- SHA512 5cc68cabb583100320d7c875fd7c46f5c618c3968ac2a7c2b60f90ec74b29349a557049c17d5c851cabb54d5ef26cd65e8d2288d70b62ede06ee1762e25dbd60
- SSDEEP 768:op8flgb2uZ5CcXQ6Q3edz3uzATaY3l0y+wj90TWIvkU5BkREPTtOjNjZocYV3A4k:owliv5Ccg67SATaYVKPkRskjNGBAa3k
- TLSH
  T1BE33A61FA6C421920DC61BC3F5625593E874C88CB39DE316ADAF53D912C68DCE2DB6E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Umbral payload

Family: Umbral

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32