Analysis
- max time kernel
59s - max time network
63s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/09/2026, 17:57
General
- Target InjectorV2.exe
- Size 229KB
- Sample260911-wjszmsbj4s
- SHA256 e9145e4a8eead07ac13d4a890581bf8e0efed8f5b848599c6e281087de93e6ab
Malware Config
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1548026277267767408/LkMMX51B6La_9k2gajY7L3Dn7qFLF8QAmy3TJSkfb04my8hdh764iOEUF-LaGx7Kvbeh
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\InjectorV2.exe"C:\Users\Admin\AppData\Local\Temp\InjectorV2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/908-0-0x0000028A82CE0000-0x0000028A82D20000-memory.dmp
memory/908-1-0x00007FFBCFDBF000-0x00007FFBCFDC0000-memory.dmp
memory/908-2-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/908-3-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/908-4-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/908-5-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/908-6-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/908-7-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/908-8-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp