umbral | de5469e4f534736efad48745cd928fa70f96f8ea5d02b87f24b542bf63843863

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grabber.exe
Size 233KB
Sample260909-l33cbavya1
SHA256 de5469e4f534736efad48745cd928fa70f96f8ea5d02b87f24b542bf63843863
MD5 1f73bdd0b5626a9dda167165455f8bd7
SHA1 0779d3f51d7f32221698c33264f472cb591f067d
SHA512 f6e1b54b298b10ae4005b2fc33e56b384a5a4a9f1923ce6690c5a78f2db0c3843730e38b299cdb515e706d513e06f92a094f1ed019eaae053f2f570f6f48f1f4
SSDEEP 6144:6DWjcgHgo3CSGwXDyoDhyiDcNdQGIxFYX+x6IE8e3Op38:ljcgHSSfX2JbOC
TLSH
T1AE347D2523B8CB23F25F9FBE95B0055FCB71A207E90BF78E1C88A5E92416741E809D57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution umbral spyware stealer

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/2884-0-0x000001FC82B10000-0x000001FC82B50000-memory.dmp	family_umbral_obfuscated

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3600	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
8	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3288	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3288	cmd.exe
5212	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3164	wmic.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5212	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3600	powershell.exe
3600	powershell.exe
3004	powershell.exe
3004	powershell.exe
3424	wmic.exe
3424	wmic.exe
3424	wmic.exe
3424	wmic.exe
5208	wmic.exe
5208	wmic.exe
5208	wmic.exe
5208	wmic.exe
4472	wmic.exe
4472	wmic.exe
4472	wmic.exe
4472	wmic.exe
3164	wmic.exe
3164	wmic.exe
3164	wmic.exe
3164	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	Grabber.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeIncreaseQuotaPrivilege	3424	wmic.exe
Token: SeSecurityPrivilege	3424	wmic.exe
Token: SeTakeOwnershipPrivilege	3424	wmic.exe
Token: SeLoadDriverPrivilege	3424	wmic.exe
Token: SeSystemProfilePrivilege	3424	wmic.exe
Token: SeSystemtimePrivilege	3424	wmic.exe
Token: SeProfSingleProcessPrivilege	3424	wmic.exe
Token: SeIncBasePriorityPrivilege	3424	wmic.exe
Token: SeCreatePagefilePrivilege	3424	wmic.exe
Token: SeBackupPrivilege	3424	wmic.exe
Token: SeRestorePrivilege	3424	wmic.exe
Token: SeShutdownPrivilege	3424	wmic.exe
Token: SeDebugPrivilege	3424	wmic.exe
Token: SeSystemEnvironmentPrivilege	3424	wmic.exe
Token: SeRemoteShutdownPrivilege	3424	wmic.exe
Token: SeUndockPrivilege	3424	wmic.exe
Token: SeManageVolumePrivilege	3424	wmic.exe
Token: 33	3424	wmic.exe
Token: 34	3424	wmic.exe
Token: 35	3424	wmic.exe
Token: 36	3424	wmic.exe
Token: SeIncreaseQuotaPrivilege	3424	wmic.exe
Token: SeSecurityPrivilege	3424	wmic.exe
Token: SeTakeOwnershipPrivilege	3424	wmic.exe
Token: SeLoadDriverPrivilege	3424	wmic.exe
Token: SeSystemProfilePrivilege	3424	wmic.exe
Token: SeSystemtimePrivilege	3424	wmic.exe
Token: SeProfSingleProcessPrivilege	3424	wmic.exe
Token: SeIncBasePriorityPrivilege	3424	wmic.exe
Token: SeCreatePagefilePrivilege	3424	wmic.exe
Token: SeBackupPrivilege	3424	wmic.exe
Token: SeRestorePrivilege	3424	wmic.exe
Token: SeShutdownPrivilege	3424	wmic.exe
Token: SeDebugPrivilege	3424	wmic.exe
Token: SeSystemEnvironmentPrivilege	3424	wmic.exe
Token: SeRemoteShutdownPrivilege	3424	wmic.exe
Token: SeUndockPrivilege	3424	wmic.exe
Token: SeManageVolumePrivilege	3424	wmic.exe
Token: 33	3424	wmic.exe
Token: 34	3424	wmic.exe
Token: 35	3424	wmic.exe
Token: 36	3424	wmic.exe
Token: SeIncreaseQuotaPrivilege	5208	wmic.exe
Token: SeSecurityPrivilege	5208	wmic.exe
Token: SeTakeOwnershipPrivilege	5208	wmic.exe
Token: SeLoadDriverPrivilege	5208	wmic.exe
Token: SeSystemProfilePrivilege	5208	wmic.exe
Token: SeSystemtimePrivilege	5208	wmic.exe
Token: SeProfSingleProcessPrivilege	5208	wmic.exe
Token: SeIncBasePriorityPrivilege	5208	wmic.exe
Token: SeCreatePagefilePrivilege	5208	wmic.exe
Token: SeBackupPrivilege	5208	wmic.exe
Token: SeRestorePrivilege	5208	wmic.exe
Token: SeShutdownPrivilege	5208	wmic.exe
Token: SeDebugPrivilege	5208	wmic.exe
Token: SeSystemEnvironmentPrivilege	5208	wmic.exe
Token: SeRemoteShutdownPrivilege	5208	wmic.exe
Token: SeUndockPrivilege	5208	wmic.exe
Token: SeManageVolumePrivilege	5208	wmic.exe
Token: 33	5208	wmic.exe
Token: 34	5208	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4992	2884	Grabber.exe	88
PID 2884 wrote to memory of 3600	2884	Grabber.exe	90
PID 2884 wrote to memory of 3004	2884	Grabber.exe	93
PID 2884 wrote to memory of 3424	2884	Grabber.exe	95
PID 2884 wrote to memory of 5208	2884	Grabber.exe	98
PID 2884 wrote to memory of 4472	2884	Grabber.exe	100
PID 2884 wrote to memory of 3164	2884	Grabber.exe	102
PID 2884 wrote to memory of 3288	2884	Grabber.exe	104
PID 3288 wrote to memory of 5212	3288	cmd.exe	106

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Grabber.exe
"C:\Users\Admin\AppData\Local\Temp\Grabber.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Grabber.exe"
  2⤵
  - Views/modifies file attributes
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5208
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Grabber.exe" && pause
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b11ec5eeecac681bbcbb325a58485259a1f3e62f99d14d73847ea54a1a1655dd
MD5 37d86e69524afe02f24cddd46a920c0b
SHA1 f9819ef9bc734f750e10e789320a8280f6547b49
SHA512 5debdda209d6598e685521b208a5dc4fdd65b3ce3b583fd1086c8af3398e93883bc35d9d845c6c78c74cf87a5118d50b3ad2f15ed41b1c6c62097835c44ee729
TLSH
T188215733F3CC86A4C89A413650CEAC1036B7C7DB419EDE9BBB84D155A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2884-10-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-9-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-3-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-4-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-6-0x000001FC9D380000-0x000001FC9D3F6000-memory.dmp

Download

memory/2884-5-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-8-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-0-0x000001FC82B10000-0x000001FC82B50000-memory.dmp

Download

memory/2884-2-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-7-0x000001FC9D300000-0x000001FC9D350000-memory.dmp

Download

memory/2884-11-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-12-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-13-0x000001FC9D040000-0x000001FC9D05E000-memory.dmp

Download

memory/2884-1-0x00007FFAB4A8F000-0x00007FFAB4A90000-memory.dmp

Download

memory/2884-38-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/2884-34-0x000001FC9D400000-0x000001FC9D412000-memory.dmp

Download

memory/2884-33-0x000001FC9D080000-0x000001FC9D08A000-memory.dmp

Download

memory/3600-14-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-21-0x000001F7E5130000-0x000001F7E5152000-memory.dmp

Download

memory/3600-22-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-23-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-24-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-25-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-27-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-18-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-17-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-16-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download

memory/3600-15-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp

Download