umbral | dfb3d8ba263039568d24773923cc650e879d55b3c866173785744b9fb668c818

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grabber.exe
Size 233KB
Sample260625-nv1jvsbv2p
SHA256 dfb3d8ba263039568d24773923cc650e879d55b3c866173785744b9fb668c818
MD5 b4b0d3686d6c03da3506a2cad1844e2d
SHA1 540d02d26d5b15f7f7d131071dfcaa721641e651
SHA512 9705c6d87b06b833746b175f1e7694d6eff9e3cc0ef62580dba2d18839022d283fd55c22efae5dec848cf873ef34a815b27d7059cd473bcee51ef8389bd9fd35
SSDEEP 6144:6D/jcgHgo3CSGwXDyoDhyiDcNdQGIxFYX+x6IE8e3Opn8:8jcgHSSfX2JbOu
TLSH
T1AA347D2523B8CB23F25F9FBE95B0055FCB71A207E90BF78E1C88A5E92416741E809D57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery umbral spyware stealer

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/4840-1-0x00000262AF0E0000-0x00000262AF120000-memory.dmp	family_umbral_obfuscated

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Grabber.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3116	cmd.exe
2196	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2692	wmic.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2196	PING.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5392	wmic.exe
5392	wmic.exe
5392	wmic.exe
5392	wmic.exe
4516	wmic.exe
4516	wmic.exe
4516	wmic.exe
4516	wmic.exe
5888	wmic.exe
5888	wmic.exe
5888	wmic.exe
5888	wmic.exe
2692	wmic.exe
2692	wmic.exe
2692	wmic.exe
2692	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	Grabber.exe
Token: SeIncreaseQuotaPrivilege	5392	wmic.exe
Token: SeSecurityPrivilege	5392	wmic.exe
Token: SeTakeOwnershipPrivilege	5392	wmic.exe
Token: SeLoadDriverPrivilege	5392	wmic.exe
Token: SeSystemProfilePrivilege	5392	wmic.exe
Token: SeSystemtimePrivilege	5392	wmic.exe
Token: SeProfSingleProcessPrivilege	5392	wmic.exe
Token: SeIncBasePriorityPrivilege	5392	wmic.exe
Token: SeCreatePagefilePrivilege	5392	wmic.exe
Token: SeBackupPrivilege	5392	wmic.exe
Token: SeRestorePrivilege	5392	wmic.exe
Token: SeShutdownPrivilege	5392	wmic.exe
Token: SeDebugPrivilege	5392	wmic.exe
Token: SeSystemEnvironmentPrivilege	5392	wmic.exe
Token: SeRemoteShutdownPrivilege	5392	wmic.exe
Token: SeUndockPrivilege	5392	wmic.exe
Token: SeManageVolumePrivilege	5392	wmic.exe
Token: 33	5392	wmic.exe
Token: 34	5392	wmic.exe
Token: 35	5392	wmic.exe
Token: 36	5392	wmic.exe
Token: SeIncreaseQuotaPrivilege	5392	wmic.exe
Token: SeSecurityPrivilege	5392	wmic.exe
Token: SeTakeOwnershipPrivilege	5392	wmic.exe
Token: SeLoadDriverPrivilege	5392	wmic.exe
Token: SeSystemProfilePrivilege	5392	wmic.exe
Token: SeSystemtimePrivilege	5392	wmic.exe
Token: SeProfSingleProcessPrivilege	5392	wmic.exe
Token: SeIncBasePriorityPrivilege	5392	wmic.exe
Token: SeCreatePagefilePrivilege	5392	wmic.exe
Token: SeBackupPrivilege	5392	wmic.exe
Token: SeRestorePrivilege	5392	wmic.exe
Token: SeShutdownPrivilege	5392	wmic.exe
Token: SeDebugPrivilege	5392	wmic.exe
Token: SeSystemEnvironmentPrivilege	5392	wmic.exe
Token: SeRemoteShutdownPrivilege	5392	wmic.exe
Token: SeUndockPrivilege	5392	wmic.exe
Token: SeManageVolumePrivilege	5392	wmic.exe
Token: 33	5392	wmic.exe
Token: 34	5392	wmic.exe
Token: 35	5392	wmic.exe
Token: 36	5392	wmic.exe
Token: SeIncreaseQuotaPrivilege	4516	wmic.exe
Token: SeSecurityPrivilege	4516	wmic.exe
Token: SeTakeOwnershipPrivilege	4516	wmic.exe
Token: SeLoadDriverPrivilege	4516	wmic.exe
Token: SeSystemProfilePrivilege	4516	wmic.exe
Token: SeSystemtimePrivilege	4516	wmic.exe
Token: SeProfSingleProcessPrivilege	4516	wmic.exe
Token: SeIncBasePriorityPrivilege	4516	wmic.exe
Token: SeCreatePagefilePrivilege	4516	wmic.exe
Token: SeBackupPrivilege	4516	wmic.exe
Token: SeRestorePrivilege	4516	wmic.exe
Token: SeShutdownPrivilege	4516	wmic.exe
Token: SeDebugPrivilege	4516	wmic.exe
Token: SeSystemEnvironmentPrivilege	4516	wmic.exe
Token: SeRemoteShutdownPrivilege	4516	wmic.exe
Token: SeUndockPrivilege	4516	wmic.exe
Token: SeManageVolumePrivilege	4516	wmic.exe
Token: 33	4516	wmic.exe
Token: 34	4516	wmic.exe
Token: 35	4516	wmic.exe
Token: 36	4516	wmic.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4248	4840	Grabber.exe	89
PID 4840 wrote to memory of 5392	4840	Grabber.exe	91
PID 4840 wrote to memory of 4516	4840	Grabber.exe	94
PID 4840 wrote to memory of 5888	4840	Grabber.exe	96
PID 4840 wrote to memory of 2692	4840	Grabber.exe	98
PID 4840 wrote to memory of 3116	4840	Grabber.exe	100
PID 3116 wrote to memory of 2196	3116	cmd.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4248	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Grabber.exe
"C:\Users\Admin\AppData\Local\Temp\Grabber.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Grabber.exe"
  2⤵
  - Views/modifies file attributes
  PID:4248
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Grabber.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4840-1-0x00000262AF0E0000-0x00000262AF120000-memory.dmp

Download

memory/4840-0-0x00007FFC7185F000-0x00007FFC71860000-memory.dmp

Download

memory/4840-2-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-3-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-4-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-5-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-8-0x00000262B0FA0000-0x00000262B0FF0000-memory.dmp

Download

memory/4840-6-0x00000262C9950000-0x00000262C99C6000-memory.dmp

Download

memory/4840-9-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-10-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-12-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-11-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-13-0x00000262B0F40000-0x00000262B0F5E000-memory.dmp

Download

memory/4840-14-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-15-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-16-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-17-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/4840-19-0x00000262B0F70000-0x00000262B0F7A000-memory.dmp

Download

memory/4840-20-0x00000262B1010000-0x00000262B1022000-memory.dmp

Download

memory/4840-24-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download