Analysis Overview
Threat Level: Shows suspicious behavior
The file https://github.com/Blank-c/Umbral-Stealer was found to be: Shows suspicious behavior.
Malicious Activity Summary
Executes dropped EXE
Obfuscated with Agile.Net obfuscator
Legitimate hosting services abused for malware hosting/C2
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-28 09:45
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-28 09:45
Reported
2024-04-28 09:47
Platform
win10v2004-20240426-en
Max time kernel
96s
Max time network
96s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | camo.githubusercontent.com | N/A | N/A |
| N/A | camo.githubusercontent.com | N/A | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeRestorePrivilege | N/A | C:\Program Files\7-Zip\7zG.exe | N/A |
| Token: 35 | N/A | C:\Program Files\7-Zip\7zG.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Program Files\7-Zip\7zG.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Program Files\7-Zip\7zG.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Blank-c/Umbral-Stealer
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5352 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Umbral.Stealer\" -ad -an -ai#7zMap21255:90:7zEvent12
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| US | 8.8.8.8:53 | camo.githubusercontent.com | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 185.199.109.133:443 | camo.githubusercontent.com | tcp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.109.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 140.82.113.21:443 | collector.github.com | tcp |
| US | 140.82.113.21:443 | collector.github.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| US | 140.82.113.21:443 | collector.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.113.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.156.26.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 8b167567021ccb1a9fdf073fa9112ef0 |
| SHA1 | 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898 |
| SHA256 | 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513 |
| SHA512 | 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54 |
\??\pipe\LOCAL\crashpad_3368_USEHYKVONHXPWSLR
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 537815e7cc5c694912ac0308147852e4 |
| SHA1 | 2ccdd9d9dc637db5462fe8119c0df261146c363c |
| SHA256 | b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f |
| SHA512 | 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | d4bb7c8513878a7bb0aa3a9e4d2b358e |
| SHA1 | 4ee33b24bbab5228af092281e92e57f348de4058 |
| SHA256 | 4ff9ee9e9fbbee2ba370764951c5f68170e6c1874d8f869d4727107c39891967 |
| SHA512 | 753180640d149deabc71cc11a78fa686d0e6fb6fa3fd92f3f0604fb79910b2162d064314e755859a1efac2143fcef83611bf0420fbdd073752903936535e8d63 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d0187fe54fbd49fbacfed2dd41c771d4 |
| SHA1 | 353b6e70d816e9c23761ff78da03386dc62449b9 |
| SHA256 | a8c471aaf9e857dbdbf4c2ce05d478219b832ff74c600c2501f4b70c14b71b26 |
| SHA512 | e0ede0b08a8185d4b07c760bc01eac2ac6c31f11767f2b835b6482b88ed52cf94d8e2117594ace72152dc94f83a60573b56c17294661fbd378300b47a275f04e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a4cac1158de6c0a4660a7a6e3ac21d8c |
| SHA1 | 93e0a31b5d1e4ec2975356eb1063404fc36e03ee |
| SHA256 | 0b26fa09ca8c0dfd1fa35cfacfca08a5c2efe4d15ac8b49e29eb0521d3d63bf5 |
| SHA512 | aaa444eceae9ee23d8842b26be4fe382809230a751ef566b26dc7583bea83e5c677bcd38cd0015c2de07549042edf68baab3df1270a50b701762f0eb61211cb7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 29543ea7d884b4ec3ae8b1f9779c705a |
| SHA1 | aee1c844c38261091be5666180ef8068e9cd9c4b |
| SHA256 | dcdebf2d5e6a8005f9720fd0fe7023bf01567f5de51d43552093f2d72f3a23dd |
| SHA512 | 60f96b3ecdaa1a2f85497618fe1b62b00f836489ac647bc4b5aeeee194b7383d406de28f5f00db8109fa2690deb16a232ea8bc6e6c4842052f91891ed90c86f5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 1f40a6fcffb0b50a8df50026d51a1123 |
| SHA1 | d956433d7d85d8c908eb5751eb5e4dd1dd1fc0ff |
| SHA256 | e6ddb55700bed4d770eb2620292415a480ab3a1ad0be0db128a34c28283f09f9 |
| SHA512 | 459c3aba7c9062f98564e0f17187b20e9a67628b0cdd2fc3bffd45a3a40bdd263898b5a5d2766bb20a4a586e5933d1f355d7caa991ce5248dbfca6e94f29c71f |
C:\Users\Admin\Downloads\Unconfirmed 701800.crdownload
| MD5 | f355889db3ff6bae624f80f41a52e619 |
| SHA1 | 47f7916272a81d313e70808270c3c351207b890f |
| SHA256 | 8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0 |
| SHA512 | bff7636f6cc0fadfd6f027e2ebda9e80fd5c64d551b2c666929b2d990509af73b082d739f14bb1497be292eafe703ebd5d7188493e2cc34b73d249fe901820eb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 50045d7dc2e45f049a2df2ce2d927428 |
| SHA1 | d83866943837f36520e3d67272e9b9898da0f7e1 |
| SHA256 | a343036b1e649089dcc5edf0731af0dafa2f482c3ca11703e794a5927743f733 |
| SHA512 | 8909cad98b41087589e8cac3998ba20b5de897a52aa820d25f0e51573bc6c88f0f3333bb002dca55fd882bcb71c6bf4c4578240128bf449f526ff2a8fd5e5cf9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579c40.TMP
| MD5 | fdbe95f7afab1a5f45e4773862c2d22d |
| SHA1 | 6450faefe07d657df8c406914792139426e90c14 |
| SHA256 | b0dc4bd162aa8797e3049ac4dc90e29d1f0a665e99fc71f9776275466df817c5 |
| SHA512 | 81fc4dbcf3f99a43b4f067d370b6d81977f1ae9619acd969ae4bec6d7e3e227c2b10cdf7e4446a2a3351edcbd2c52b46e3d691519aa3f44682f8820af0c8ddb7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | cf89fde3ad837c98bd43b83a202dc736 |
| SHA1 | bba15641ebd9494bfb41d89f6df33d77a4488016 |
| SHA256 | b1b4817ea2c64ef5326fce12b25ab08bd5d8b47293303284e0ccb02be83d8b83 |
| SHA512 | a672d251a068da0651604cdaaa2b4cca62a337a6df61b91e7e3c19a35627b71f8a3b62ee7e649b4f0fcf6a1c3e57324b9dc79569838a2ec9a72debe7a22d7255 |
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
| MD5 | d91fb6867df7e4303d98b5e90faae73c |
| SHA1 | 496f53ad8cd9381f1c1b577a73e978081002c1db |
| SHA256 | bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344 |
| SHA512 | 5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9 |
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe.config
| MD5 | dccd44fb11b8e4ebdfb822e809a54b6f |
| SHA1 | 1889d5ae8c7c70c051cbde104af6e0f31f8c1b63 |
| SHA256 | 6862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158 |
| SHA512 | dadffe41bdadfc3a79cb34369c9a8b37ce4833aee18058b02dcb13d64007f022b80b63ab404572c60278937cf83b06b00712ff9ee302e725b9d5c7fe14bd5f50 |
memory/2224-320-0x000002B761DC0000-0x000002B761DE2000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuButton.dll
| MD5 | 21f999e5ac72a16077511d41590822de |
| SHA1 | d8bb1a8a291f73cdf2b5658b2b65736c87db19dd |
| SHA256 | 2a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71 |
| SHA512 | e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3 |
memory/2224-322-0x000002B762230000-0x000002B762250000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuTextBox.dll
| MD5 | fd2042c49df3e74e096b8cee8cc9fe43 |
| SHA1 | 4ccdb0e13c24fb71f502d50e34f00c39bcacf307 |
| SHA256 | 4569393e1aad7498c6a7c8a84f79d0cd7a1d0656e912d0ddb607b61163673976 |
| SHA512 | c93ad9cb411c311b0feeefdf2089c0c13098c7d2bab56345f4e9a7fc515965a3893c613d494adbbb066801eeb3dc32237a8322f7a5f876284a06b447efdad641 |
memory/2224-324-0x000002B762250000-0x000002B762270000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuLabel.dll
| MD5 | 73ca0338c9c3b7901d3621b346c76a7a |
| SHA1 | 79d26ee6e1bf0beb2ee0593562592de8ff01935b |
| SHA256 | a505193910f7b8fd6123c00bb437bff3d2a4f28c970e24207d395554765e6ad4 |
| SHA512 | 53e0b84dffbec8e465955bc91f1207ba56a55543ba3c00c66997b3ee3d4cb904e027915a12f7a9dc79ffef4cde633c9b7543436c4ab97785ca2169bc3d4aeede |
memory/2224-326-0x000002B77C300000-0x000002B77C36E000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuColorTransition.dll
| MD5 | 539d803013c0b1592d0e17a740d72687 |
| SHA1 | b0ce15e0f096d027b1d1482afa9d93bafd160f7a |
| SHA256 | 500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81 |
| SHA512 | 77d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd |
memory/2224-332-0x000002B762290000-0x000002B7622A0000-memory.dmp
memory/2224-334-0x000002B7622C0000-0x000002B7622DE000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuCheckBox.dll
| MD5 | ef11f59a9381df17d7ab94434f79f260 |
| SHA1 | ec11e46a636fe3927fd5fa7c30be65b958853ef0 |
| SHA256 | 390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4 |
| SHA512 | 612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d |
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuShadowPanel.dll
| MD5 | ebaf1a6efa8c7a04d174be7e0df602a7 |
| SHA1 | ce08c80e52b6cf3f62ba82408d8f32ae6bcef0d8 |
| SHA256 | 1858b16074d7f9b73f462e3adcc77309800594fa96f2e0904c810eda4eaf5e86 |
| SHA512 | 4ffd5dcb59a4a03273c4e88047c7d398f098302b9485d07cf5549ca0d72467102aafa69298e248250df154a8b09f7560e634cca9cb1af2838baf3965aa645b31 |
memory/2224-330-0x000002B77C490000-0x000002B77C4EA000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.1.5.3.dll
| MD5 | 41c216d27c71a227774e680e95e99f31 |
| SHA1 | 0a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5 |
| SHA256 | 012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305 |
| SHA512 | e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651 |
memory/2224-328-0x000002B762280000-0x000002B76228E000-memory.dmp
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.Licensing.dll
| MD5 | 2b2740e0c34a46de31cf9da8a75d77cf |
| SHA1 | 242324f1112e6387cda41686291b6e9a415eeb8c |
| SHA256 | a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43 |
| SHA512 | 605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40 |
memory/2224-336-0x000002B77C780000-0x000002B77C8CA000-memory.dmp
memory/2224-337-0x000002B77C630000-0x000002B77C746000-memory.dmp
memory/2224-338-0x000002B77C4F0000-0x000002B77C520000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 23d0f3e132a021688040356991b1c978 |
| SHA1 | 5373ecd8851a6a149de983c543e1ae6c9b150b0d |
| SHA256 | b25aa78ea2d1f16a49f6a788a43ca2c79953d4ad0f0f5414fcfeaba62ce03e53 |
| SHA512 | 9bc5484415ac42f051daf38f5c8e57df54d3b72a90f99233d76c5d0f0ad6325bd04c0c5e6ccf4b2c6141ddd1123cc137bea8fc2597951708e96461929dc9758e |