umbral | d14c5940b163dda50170276c84997033990e0797a2382be569dd706351d9376c

Analysis

max time kernel
149s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CREBTER 2018.exe
Size 1022KB
Sample261024-vs5t5abs3s
SHA256 d14c5940b163dda50170276c84997033990e0797a2382be569dd706351d9376c
MD5 5d1dc0768f78a2721c83450e432d3499
SHA1 d8caba6403d6355b526432af59c795f3cc90e260
SHA512 c3c9551f1fa268388a015afe6e55a5fd204b03bf80f39818ed10c18a5e57254e83d1d445d59a6986df812d54cad23050a233139ad92d09049d0b24761dcb4976
SSDEEP 24576:THrhxd+JbH58Zde8d8RIKLqNtto8Qv8eg6oc3Dc:TLwZHCZdDd8J84w
TLSH
T1DE2523D95F4B0A28D07DAFB4851291CFF389C70EA33734D682FE36637EAEA145485251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery umbral stealer

Malware Config

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1537631553251704915/pYjuZXSVqFJF8UDGNGHbS13FUlJA2WvuLsGU39gflbIsE9iTkJ1qFg8UBZttARkB32aJ

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral2/files/0x001500000002839c-4.dat	family_umbral
behavioral2/files/0x001500000002839c-4.dat	family_umbral_obfuscated
behavioral2/memory/2144-26-0x000002418FA60000-0x000002418FAA0000-memory.dmp	family_umbral
behavioral2/memory/2144-26-0x000002418FA60000-0x000002418FAA0000-memory.dmp	family_umbral_obfuscated

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	CREBTER 2018.exe

Executes dropped EXE 2 IoCs

pid	Process
2144	1.exe
3508	unpacker.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	ip-api.com

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
604	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unpacker.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
604	wmic.exe
604	wmic.exe
604	wmic.exe
604	wmic.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	1.exe
Token: SeIncreaseQuotaPrivilege	604	wmic.exe
Token: SeSecurityPrivilege	604	wmic.exe
Token: SeTakeOwnershipPrivilege	604	wmic.exe
Token: SeLoadDriverPrivilege	604	wmic.exe
Token: SeSystemProfilePrivilege	604	wmic.exe
Token: SeSystemtimePrivilege	604	wmic.exe
Token: SeProfSingleProcessPrivilege	604	wmic.exe
Token: SeIncBasePriorityPrivilege	604	wmic.exe
Token: SeCreatePagefilePrivilege	604	wmic.exe
Token: SeBackupPrivilege	604	wmic.exe
Token: SeRestorePrivilege	604	wmic.exe
Token: SeShutdownPrivilege	604	wmic.exe
Token: SeDebugPrivilege	604	wmic.exe
Token: SeSystemEnvironmentPrivilege	604	wmic.exe
Token: SeRemoteShutdownPrivilege	604	wmic.exe
Token: SeUndockPrivilege	604	wmic.exe
Token: SeManageVolumePrivilege	604	wmic.exe
Token: 33	604	wmic.exe
Token: 34	604	wmic.exe
Token: 35	604	wmic.exe
Token: 36	604	wmic.exe
Token: SeIncreaseQuotaPrivilege	604	wmic.exe
Token: SeSecurityPrivilege	604	wmic.exe
Token: SeTakeOwnershipPrivilege	604	wmic.exe
Token: SeLoadDriverPrivilege	604	wmic.exe
Token: SeSystemProfilePrivilege	604	wmic.exe
Token: SeSystemtimePrivilege	604	wmic.exe
Token: SeProfSingleProcessPrivilege	604	wmic.exe
Token: SeIncBasePriorityPrivilege	604	wmic.exe
Token: SeCreatePagefilePrivilege	604	wmic.exe
Token: SeBackupPrivilege	604	wmic.exe
Token: SeRestorePrivilege	604	wmic.exe
Token: SeShutdownPrivilege	604	wmic.exe
Token: SeDebugPrivilege	604	wmic.exe
Token: SeSystemEnvironmentPrivilege	604	wmic.exe
Token: SeRemoteShutdownPrivilege	604	wmic.exe
Token: SeUndockPrivilege	604	wmic.exe
Token: SeManageVolumePrivilege	604	wmic.exe
Token: 33	604	wmic.exe
Token: 34	604	wmic.exe
Token: 35	604	wmic.exe
Token: 36	604	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2144	1236	CREBTER 2018.exe	84
PID 1236 wrote to memory of 3508	1236	CREBTER 2018.exe	85
PID 2144 wrote to memory of 604	2144	1.exe	86

C:\Users\Admin\AppData\Local\Temp\CREBTER 2018.exe
"C:\Users\Admin\AppData\Local\Temp\CREBTER 2018.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Roaming\1.exe
  "C:\Users\Admin\AppData\Roaming\1.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:604
- C:\Users\Admin\AppData\Roaming\unpacker.exe
  "C:\Users\Admin\AppData\Roaming\unpacker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Roaming\1.exe
Size 232KB
SHA256 635441dcb970febe793147a3f7bd9262a45065c4f335dd7eb1d749b0ce920248
MD5 82376e31ff46bfb80acafc4d2d2f71dd
SHA1 e7b934f7d5f7dacb25ef13bef0d431c01496bb34
SHA512 7c91b30453e2004c802bbb2e7e15d585fa219675f1a3eb08ea32e561d9bbbd202522d24146946a42973e23806400c6be0ce151ba4b2c5d3c6a8b954eb06a3acd
SSDEEP 6144:iloZM+rIkd8g+EtXHkv/iD4jfCtxov8e1mKi:soZtL+EP8j2xQE
TLSH
T174345A5937B89F12E21F8BBEE5B1149F8B71F113E90AF78E0C8895FC1412B42E905A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpacker.exe

Path C:\Users\Admin\AppData\Roaming\unpacker.exe
Size 780KB
SHA256 333b0c23504f78bfb5def7a0e3441dd04f8b35027643d41eecda50e0b78e4770
MD5 22873c79d49c1e4f39ae4609f6dcc89d
SHA1 004bcb7f21163727420498a856e054fe3af06f75
SHA512 cb008c1d035c7477debd89cc6e1b067238f4071fac384e6fb2fe2f3179ba79ee6bc5303dee0f9ae6feb248de892f7dd8f5a42217f17f80c65484e87c135d83fd
SSDEEP 24576:sVq9qRhcbsxOf50qhchohvRopvwihQjFhs:H9qRhc6OflhOqvRMSjFe
TLSH
T1E405124271CCBF3BD17D6FB066B0BD4154BFE4650A64AB6908FC42C7AA4AE04FD8191E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-0-0x00000000003E0000-0x00000000004E6000-memory.dmp

Download

memory/2144-26-0x000002418FA60000-0x000002418FAA0000-memory.dmp

Download

memory/3508-31-0x0000000000820000-0x00000000008EA000-memory.dmp

Download

memory/3508-32-0x0000000005740000-0x0000000005CE6000-memory.dmp

Download

memory/3508-33-0x0000000005190000-0x0000000005222000-memory.dmp

Download

memory/3508-34-0x0000000005250000-0x000000000525A000-memory.dmp

Download