umbral | 64f6576c6db1eaaefbe0ab36e362592c8b27ff856cfcb29c032d06c1f289df1c | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 17:42

Sharing

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

231KB
MD5

0eca651a9a275b0674a052b757f4b9ae
SHA1

d646b68d18a28ba263ea2930e58f0b30ac83b4a3
SHA256

64f6576c6db1eaaefbe0ab36e362592c8b27ff856cfcb29c032d06c1f289df1c
SHA512

d1f62b20625a982c3b59fdc56af47833b5f3e0ed2bb3aa03b1c8b71c3160999d87bc53f9f4f7bf1cdf6d45d87ff6e5c96a5cc0977c0da9b6ec1278b3c24870d5
SSDEEP

6144:RloZM+rIkd8g+EtXHkv/iD4hE3sR8e1mRi:joZtL+EP8h/B

Score

10^/10

Malware Config

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2796-0-0x0000024037360000-0x00000240373A0000-memory.dmp family_umbral
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WaveInstaller.exe

description pid process

Token: SeDebugPrivilege 2796 WaveInstaller.exe

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x0000024037360000-0x00000240373A0000-memory.dmp

Filesize
256KB

Download
memory/2796-1-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

Filesize
8KB

Download
memory/2796-2-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Filesize
10.8MB

Download
memory/2796-3-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Filesize
10.8MB

Download