Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 18:46
Behavioral task
behavioral1
Sample
Grabber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Grabber.exe
- Size 233KB
- Sample260720-xetwtab17j
- SHA256 da39a865fa3677ed9a805cbcccf3f7889430b759d17f2732597c0d6f00e52a9b
- MD5 10e4ff3feb58f17dcd952d2787c14ffb
- SHA1 5c74f9f3e87536c224722725a5df04a6366de9a6
- SHA512 6a067d8531b557007af9dcd64903f12cc9aade234ebf14628ffd782ed83ce687cfa0e89ff4ca6ec4b241812b7d30368b2f9d66a16fe364c87e8a8eccbdb3715c
- SSDEEP 6144:6DpjcgHgo3CSGwXDyoDhyiDcNdQGIxFYX+x6IE8e3Opq8:ajcgHSSfX2JbOZ
- TLSH T18D347D2523B8CB23F25F9FBE95B0055FCB71A207E90BF78E1C88A5E92416741E809D57
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3428-0-0x0000015D129D0000-0x0000015D12A10000-memory.dmp family_umbral_obfuscated - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4832 wmic.exe 4832 wmic.exe 4832 wmic.exe 4832 wmic.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3428 Grabber.exe Token: SeIncreaseQuotaPrivilege 4832 wmic.exe Token: SeSecurityPrivilege 4832 wmic.exe Token: SeTakeOwnershipPrivilege 4832 wmic.exe Token: SeLoadDriverPrivilege 4832 wmic.exe Token: SeSystemProfilePrivilege 4832 wmic.exe Token: SeSystemtimePrivilege 4832 wmic.exe Token: SeProfSingleProcessPrivilege 4832 wmic.exe Token: SeIncBasePriorityPrivilege 4832 wmic.exe Token: SeCreatePagefilePrivilege 4832 wmic.exe Token: SeBackupPrivilege 4832 wmic.exe Token: SeRestorePrivilege 4832 wmic.exe Token: SeShutdownPrivilege 4832 wmic.exe Token: SeDebugPrivilege 4832 wmic.exe Token: SeSystemEnvironmentPrivilege 4832 wmic.exe Token: SeRemoteShutdownPrivilege 4832 wmic.exe Token: SeUndockPrivilege 4832 wmic.exe Token: SeManageVolumePrivilege 4832 wmic.exe Token: 33 4832 wmic.exe Token: 34 4832 wmic.exe Token: 35 4832 wmic.exe Token: 36 4832 wmic.exe Token: SeIncreaseQuotaPrivilege 4832 wmic.exe Token: SeSecurityPrivilege 4832 wmic.exe Token: SeTakeOwnershipPrivilege 4832 wmic.exe Token: SeLoadDriverPrivilege 4832 wmic.exe Token: SeSystemProfilePrivilege 4832 wmic.exe Token: SeSystemtimePrivilege 4832 wmic.exe Token: SeProfSingleProcessPrivilege 4832 wmic.exe Token: SeIncBasePriorityPrivilege 4832 wmic.exe Token: SeCreatePagefilePrivilege 4832 wmic.exe Token: SeBackupPrivilege 4832 wmic.exe Token: SeRestorePrivilege 4832 wmic.exe Token: SeShutdownPrivilege 4832 wmic.exe Token: SeDebugPrivilege 4832 wmic.exe Token: SeSystemEnvironmentPrivilege 4832 wmic.exe Token: SeRemoteShutdownPrivilege 4832 wmic.exe Token: SeUndockPrivilege 4832 wmic.exe Token: SeManageVolumePrivilege 4832 wmic.exe Token: 33 4832 wmic.exe Token: 34 4832 wmic.exe Token: 35 4832 wmic.exe Token: 36 4832 wmic.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4832 3428 Grabber.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Grabber.exe"C:\Users\Admin\AppData\Local\Temp\Grabber.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-