Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 18:18
General
- Target BlueStacks_5.22.130.exe
- Size 3.4MB
- Sample261027-wx2tpse19v
- SHA256 2c617a8f47076ddb46f41e94d8590e12c1b4e162809bba254b77ed490dc980cc
Malware Config
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1561470753034076181/eZq3sAdK4om_Vxgk3ZYK2g2W7singS26zkpWZzs8QaPymMuWnjEsjXz5Wlc8AFG-yMto
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 4 IoCs
- Executes dropped EXE 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlueStacks_5.22.130.exe"C:\Users\Admin\AppData\Local\Temp\BlueStacks_5.22.130.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\BlueStacks_5.22.130 (1).exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\BlueStacks_5.22.130 (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4FCC6239\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FCC6239\BlueStacksInstaller.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4FCC6239\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FCC6239\HD-CheckCpu.exe" --cmd checkHypervEnabled4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FCC6239\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FCC6239\HD-CheckCpu.exe" --cmd checkSSE44⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2568.exe"C:\Users\Admin\AppData\Local\Temp\2568.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2568.exe
backicon.png
change_click.png
close_red.png
custom.png
discord_icon.png
discord_icon_hover.png
exit_close_click.png
folder.png
help_icon.png
info_icon.png
installer_bg.jpg
installer_logo.png
installer_minimize.png
loader.png
logo_text.png
minimize_progress_click.png
setpath.png
BlueStacksInstaller.exe
BlueStacksInstaller.exe.config
HD-CheckCpu.exe
JSON.dll
i18n.en-US.txt
ThemeFile
installer_bg_2.jpg
installer_bg_4.jpg
installer_bg_7.jpg
BlueStacks_5.22.130 (1).exe
Discord.exe
memory/1800-212-0x000001B38B410000-0x000001B38B650000-memory.dmp
memory/1800-217-0x000001B3A5DA0000-0x000001B3A5F62000-memory.dmp
memory/1928-155-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-158-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-172-0x000000001D040000-0x000000001D04E000-memory.dmp
memory/1928-170-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-169-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-165-0x000000001D180000-0x000000001D6A8000-memory.dmp
memory/1928-168-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-167-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-186-0x00000000211B0000-0x00000000211B8000-memory.dmp
memory/1928-159-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-148-0x00007FFD5908F000-0x00007FFD59090000-memory.dmp
memory/1928-171-0x000000001D070000-0x000000001D0AE000-memory.dmp
memory/1928-198-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-199-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-200-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-156-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-154-0x000000001B390000-0x000000001B3F8000-memory.dmp
memory/1928-152-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-151-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/1928-150-0x0000000000440000-0x00000000004E4000-memory.dmp
memory/2360-222-0x00007FF7C5380000-0x00007FF7C5396000-memory.dmp
memory/2360-189-0x00007FF7C5380000-0x00007FF7C5396000-memory.dmp
memory/5860-221-0x00000219BC850000-0x00000219BC890000-memory.dmp