umbral | 1fa1ca42abac4f9bb826940e36893d4e6e2612a6cc314c490e593b2834027082

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
25/04/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoiceBoost.exe
Size 375KB
Sample260425-mlq4dsft51
SHA256 1fa1ca42abac4f9bb826940e36893d4e6e2612a6cc314c490e593b2834027082
MD5 185b0925742f433f89d416481534ab94
SHA1 9101c41e86227b87297421aa247017adc63013c2
SHA512 f3af6fe85ec04cf169cc3bb2d961d0fee0bd8cbd09fe78e347b8ddaace395699a9871ec252a3cc40131ea91153ddb72c2e98dbb6cea668652f5f76e97a0e5ffc
SSDEEP 6144:b0dqFlgCEQXOT5TsFbNp1Xf5fxe8eVSfI/:b0dV5sO8xfxbw
TLSH
T120846C88D694CA02D64F0ABD35A0A0DA9B75A427DF2EF3EE05CCC5B8203571E4D4DD9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution umbral spyware stealer

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/4624-0-0x00000199E1200000-0x00000199E1264000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3352	powershell.exe
640	powershell.exe
4548	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
640	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	VoiceBoost.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
640	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3352	powershell.exe
3352	powershell.exe
640	powershell.exe
640	powershell.exe
4548	powershell.exe
4548	powershell.exe
6012	powershell.exe
6012	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	VoiceBoost.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeIncreaseQuotaPrivilege	3352	powershell.exe
Token: SeSecurityPrivilege	3352	powershell.exe
Token: SeTakeOwnershipPrivilege	3352	powershell.exe
Token: SeLoadDriverPrivilege	3352	powershell.exe
Token: SeSystemProfilePrivilege	3352	powershell.exe
Token: SeSystemtimePrivilege	3352	powershell.exe
Token: SeProfSingleProcessPrivilege	3352	powershell.exe
Token: SeIncBasePriorityPrivilege	3352	powershell.exe
Token: SeCreatePagefilePrivilege	3352	powershell.exe
Token: SeBackupPrivilege	3352	powershell.exe
Token: SeRestorePrivilege	3352	powershell.exe
Token: SeShutdownPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeSystemEnvironmentPrivilege	3352	powershell.exe
Token: SeRemoteShutdownPrivilege	3352	powershell.exe
Token: SeUndockPrivilege	3352	powershell.exe
Token: SeManageVolumePrivilege	3352	powershell.exe
Token: 33	3352	powershell.exe
Token: 34	3352	powershell.exe
Token: 35	3352	powershell.exe
Token: 36	3352	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	6012	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2908	4624	VoiceBoost.exe	89
PID 4624 wrote to memory of 3352	4624	VoiceBoost.exe	91
PID 4624 wrote to memory of 640	4624	VoiceBoost.exe	94
PID 4624 wrote to memory of 4548	4624	VoiceBoost.exe	96
PID 4624 wrote to memory of 6012	4624	VoiceBoost.exe	98

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe
"C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe"
  2⤵
  - Views/modifies file attributes
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\VoiceBoost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7bb0fee5ca243b4136b1dc202682d93cc8344608fb6241ef2b956ac9481c6672
MD5 1c78e6712153b05f3a7c14da914a5362
SHA1 fc186acc862beca9cbef5e80a805dfcb7537e4c0
SHA512 ea2de7e8738716e039a0ccb8e88859d1f1baf0e0c596d926d43590941c5c500ee7f1e739be92692f782e82a8d24f0a9d216fe337d466dbd0da6ee6dd95eade60
TLSH
T169217463B3DDC850CC99023A609C9C9076B697C780DEDF9B2EC4C211907FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 865f30e2e1999202fc5d9917c6a77c0faa430ba0d8e454a2511630c7a3cdbb68
MD5 4359546acae1310d9a8a7c8e58c7adca
SHA1 5ab2be19efcc2443e12ca714d9bb73943bc2ca6c
SHA512 528e942242886c7f1d20c2efd48cfde452754e6e3755d7ff0faa11daa85c81c82b64bc5e57d7a3ce61bffcce03dc18c8973ecb1ce754e4fb705fda0416d6dc5e
TLSH
T1E2114463B79CC8A0CC89463A409C9D9175B6DBC780EADECB3EC4C114E1BF588DB201A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 03502fe7eba8d8ea6783f561616e1ca0cfa8ab361db9ff36807da59b52233e4d
MD5 1dd003ff444ad7f5510a7921c64c80f1
SHA1 1f25434b32ab742ecf38b69fb1d3800f7f7b0cf3
SHA512 6c7fb7cec92f1b18a76c35c9287a2691fd9caa841d3ae6d3450d213b55bd339ae4db7e47d22cfc59a9e1fedfc409849f1967026c71ad8c2067dd66b6596b2d77
TLSH
T1FB119323B3DC8961CC9A023B409C9CA075B2C7C7809EDE9B2EC4C205A0BF899CB201A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jjztk2m1.uhp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jjztk2m1.uhp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/640-42-0x00000216DC0B0000-0x00000216DC0B8000-memory.dmp

Download

memory/640-41-0x00000216C3AB0000-0x00000216C3ABC000-memory.dmp

Download

memory/3352-17-0x00000173BAC30000-0x00000173BAC52000-memory.dmp

Download

memory/3352-25-0x00000173BAC60000-0x00000173BAC70000-memory.dmp

Download

memory/3352-26-0x00000173BAC60000-0x00000173BAC70000-memory.dmp

Download

memory/3352-29-0x00000173A2560000-0x00000173A256C000-memory.dmp

Download

memory/3352-30-0x00000173A2600000-0x00000173A2608000-memory.dmp

Download

memory/3352-16-0x00000173BAC60000-0x00000173BAC70000-memory.dmp

Download

memory/3352-15-0x00000173BAC60000-0x00000173BAC70000-memory.dmp

Download

memory/4548-57-0x000002DB9C250000-0x000002DB9C25C000-memory.dmp

Download

memory/4548-56-0x000002DB9BF80000-0x000002DB9C11F000-memory.dmp

Download

memory/4624-45-0x00000199FB960000-0x00000199FB9B0000-memory.dmp

Download

memory/4624-44-0x00000199FB9E0000-0x00000199FBA56000-memory.dmp

Download

memory/4624-0-0x00000199E1200000-0x00000199E1264000-memory.dmp

Download

memory/4624-46-0x00000199FB7F0000-0x00000199FB80E000-memory.dmp

Download

memory/4624-2-0x00000199E2DC0000-0x00000199E2DCC000-memory.dmp

Download

memory/4624-3-0x00000199E2DD0000-0x00000199E2DD8000-memory.dmp

Download

memory/4624-4-0x00000199FB850000-0x00000199FB860000-memory.dmp

Download

memory/4624-1-0x00000199FB850000-0x00000199FB860000-memory.dmp

Download

memory/4624-70-0x00000199FB820000-0x00000199FB82A000-memory.dmp

Download

memory/4624-71-0x00000199FB9B0000-0x00000199FB9C2000-memory.dmp

Download

memory/6012-68-0x000002C3764A0000-0x000002C3764AC000-memory.dmp

Download

memory/6012-67-0x000002C374A80000-0x000002C374C1F000-memory.dmp

Download