Analysis
- user interaction
yes - max time kernel
14s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 02:19
General
- Target Nuker.exe
- Size 16.2MB
- Sample260912-cr862sbe47
- SHA256 1865097f4409bbececdc16eb9a954277e111c488a0bcab48cc7994259a87d3f6
Malware Config
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1545889048101523570/JkWyyahtPT9tTzdhhjQQAu0u39L0hFMuop8lAPd49wAyuS6EPBiPaRxWVx8ePFLzH8_-
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nuker.exe"C:\Users\Admin\AppData\Local\Temp\Nuker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Python.exe"C:\Users\Admin\AppData\Local\Temp\Python.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Python.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
-
-
-
C:\Users\Admin\AppData\Local\Temp\Lax.exe"C:\Users\Admin\AppData\Local\Temp\Lax.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lax.exeC:\Users\Admin\AppData\Local\Temp\Lax.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Qusai Nuker - Authentication4⤵
- Executes a command shell one-liner
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Lax.exe
_asyncio.pyd
_bz2.pyd
_lzma.pyd
_socket.pyd
_uuid.pyd
libssl-1_1.dll
_helpers_c.pyd
select.pyd
unicodedata.pyd
Python.exe
__PSScriptPolicyTest_v55bk3kn.r1h.ps1
81d243bd2c585b0f4821__mypyc.pyd
Lax.dll
_ctypes.pyd
_hashlib.pyd
_overlapped.pyd
_queue.pyd
_ssl.pyd
cd.pyd
libcrypto-1_1.dll
libffi-7.dll
_multidict.pyd
python310.dll
vcruntime140.dll
_quoting_c.pyd
memory/1428-133-0x00007FF705140000-0x00007FF707E2D000-memory.dmp
memory/2020-134-0x00007FF705140000-0x00007FF707E2D000-memory.dmp
memory/2020-135-0x00007FF806470000-0x00007FF808673000-memory.dmp
memory/3480-23-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-76-0x0000020EF97E0000-0x0000020EF9830000-memory.dmp
memory/3480-141-0x0000020EF96E0000-0x0000020EF96F2000-memory.dmp
memory/3480-152-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-24-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-75-0x0000020EF9760000-0x0000020EF97D6000-memory.dmp
memory/3480-22-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-140-0x0000020EE0D50000-0x0000020EE0D5A000-memory.dmp
memory/3480-18-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-17-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-16-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-15-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-14-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/3480-77-0x0000020EDF440000-0x0000020EDF45E000-memory.dmp
memory/3480-13-0x0000020EDEEA0000-0x0000020EDEEE0000-memory.dmp
memory/3592-28-0x0000025359560000-0x0000025359612000-memory.dmp
memory/3592-21-0x00000253594B0000-0x00000253594D2000-memory.dmp
memory/3592-27-0x0000025359540000-0x000002535955E000-memory.dmp
memory/3592-29-0x0000025359530000-0x000002535953A000-memory.dmp
memory/4240-3-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4240-2-0x0000000000750000-0x0000000001796000-memory.dmp
memory/4240-5-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4240-0-0x00007FF81C4EF000-0x00007FF81C4F0000-memory.dmp
memory/4240-1-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4240-37-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp