Analysis
- max time kernel
148s - max time network
97s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 23:11
General
- Target umbra.exe
- Size 1.2MB
- Sample260704-26k57sez21
- SHA256 0fabbd3848a827d131f3342202bdbf41e982d1d9abd09201f0a157b820b17487
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\umbra.exe"C:\Users\Admin\AppData\Local\Temp\umbra.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1052-0-0x00007FFB1226F000-0x00007FFB12270000-memory.dmp
memory/1052-1-0x0000026C03530000-0x0000026C03666000-memory.dmp
memory/1052-3-0x0000026C05480000-0x0000026C0553A000-memory.dmp
memory/1052-2-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-4-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-5-0x0000026C03B70000-0x0000026C03B88000-memory.dmp
memory/1052-6-0x0000026C1E9A0000-0x0000026C1EA6A000-memory.dmp
memory/1052-7-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-8-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-9-0x0000026C23280000-0x0000026C23288000-memory.dmp
memory/1052-11-0x0000026C236D0000-0x0000026C236DE000-memory.dmp
memory/1052-10-0x0000026C23710000-0x0000026C2374E000-memory.dmp
memory/1052-12-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-13-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-14-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-15-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp
memory/1052-16-0x00007FFB120E0000-0x00007FFB12A84000-memory.dmp