umbral | 00bc0bbf9e1fc390c44b18e674faed05f452332bae1a96b85bcd74530d34e771

Analysis

max time kernel
898s
max time network
432s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-fr
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-frlocale:fr-fros:windows10-ltsc_2021-x64systemwindows
submitted
25/08/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stresserka c2/doomstresser-c2-ddosiara.exe
Size 229KB
Sample260825-jsdj4aycmf
SHA256 00bc0bbf9e1fc390c44b18e674faed05f452332bae1a96b85bcd74530d34e771
MD5 b51e46f32f11955af9a0fb257ce29309
SHA1 bc580c4b55d4b6abe917b0563d5db9d0ec94df8a
SHA512 4cf783af8f401423f5aec6fee84ffb9e6635ba0dbb792c0b67917c9053030ad3b35109e4ec9f5bf352da30cddffb06f98de6b9521536ce95cbf011b6d51030a5
SSDEEP 6144:tloZMLrIkd8g+EtXHkv/iD4pKI5EKtFu8r20VJgdSb8e1m0Ei:voZ0L+EP8pKI5EKtFu8r20VJgA3
TLSH
T1AE346C4937B8CB17E25F8BBED5B1148F87B1F143E90AF78E0C8895E82411742E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution umbral spyware stealer

Malware Config

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1481679436427296819/9O-aXlkzbRp2jbvhSekh5_nOs25zvm2buzGuIyD0DFLoHYSTeqCgPMg6tnAxjxjIraWD

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 2 IoCs

resource	yara_rule
behavioral3/memory/2896-0-0x000002A62CE50000-0x000002A62CE90000-memory.dmp	family_umbral
behavioral3/memory/2896-0-0x000002A62CE50000-0x000002A62CE90000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
648	powershell.exe
3784	powershell.exe
2404	powershell.exe
520	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3784	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	doomstresser-c2-ddosiara.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3784	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
17	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	ip-api.com
14	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4408	wmic.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4128	wmic.exe
4128	wmic.exe
4128	wmic.exe
4128	wmic.exe
2896	doomstresser-c2-ddosiara.exe
648	powershell.exe
648	powershell.exe
3784	powershell.exe
3784	powershell.exe
2404	powershell.exe
2404	powershell.exe
4616	powershell.exe
4616	powershell.exe
2432	wmic.exe
2432	wmic.exe
2432	wmic.exe
2432	wmic.exe
4364	wmic.exe
4364	wmic.exe
4364	wmic.exe
4364	wmic.exe
1076	wmic.exe
1076	wmic.exe
1076	wmic.exe
1076	wmic.exe
520	powershell.exe
520	powershell.exe
4408	wmic.exe
4408	wmic.exe
4408	wmic.exe
4408	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	doomstresser-c2-ddosiara.exe
Token: SeIncreaseQuotaPrivilege	4128	wmic.exe
Token: SeSecurityPrivilege	4128	wmic.exe
Token: SeTakeOwnershipPrivilege	4128	wmic.exe
Token: SeLoadDriverPrivilege	4128	wmic.exe
Token: SeSystemProfilePrivilege	4128	wmic.exe
Token: SeSystemtimePrivilege	4128	wmic.exe
Token: SeProfSingleProcessPrivilege	4128	wmic.exe
Token: SeIncBasePriorityPrivilege	4128	wmic.exe
Token: SeCreatePagefilePrivilege	4128	wmic.exe
Token: SeBackupPrivilege	4128	wmic.exe
Token: SeRestorePrivilege	4128	wmic.exe
Token: SeShutdownPrivilege	4128	wmic.exe
Token: SeDebugPrivilege	4128	wmic.exe
Token: SeSystemEnvironmentPrivilege	4128	wmic.exe
Token: SeRemoteShutdownPrivilege	4128	wmic.exe
Token: SeUndockPrivilege	4128	wmic.exe
Token: SeManageVolumePrivilege	4128	wmic.exe
Token: 33	4128	wmic.exe
Token: 34	4128	wmic.exe
Token: 35	4128	wmic.exe
Token: 36	4128	wmic.exe
Token: SeIncreaseQuotaPrivilege	4128	wmic.exe
Token: SeSecurityPrivilege	4128	wmic.exe
Token: SeTakeOwnershipPrivilege	4128	wmic.exe
Token: SeLoadDriverPrivilege	4128	wmic.exe
Token: SeSystemProfilePrivilege	4128	wmic.exe
Token: SeSystemtimePrivilege	4128	wmic.exe
Token: SeProfSingleProcessPrivilege	4128	wmic.exe
Token: SeIncBasePriorityPrivilege	4128	wmic.exe
Token: SeCreatePagefilePrivilege	4128	wmic.exe
Token: SeBackupPrivilege	4128	wmic.exe
Token: SeRestorePrivilege	4128	wmic.exe
Token: SeShutdownPrivilege	4128	wmic.exe
Token: SeDebugPrivilege	4128	wmic.exe
Token: SeSystemEnvironmentPrivilege	4128	wmic.exe
Token: SeRemoteShutdownPrivilege	4128	wmic.exe
Token: SeUndockPrivilege	4128	wmic.exe
Token: SeManageVolumePrivilege	4128	wmic.exe
Token: 33	4128	wmic.exe
Token: 34	4128	wmic.exe
Token: 35	4128	wmic.exe
Token: 36	4128	wmic.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeIncreaseQuotaPrivilege	648	powershell.exe
Token: SeSecurityPrivilege	648	powershell.exe
Token: SeTakeOwnershipPrivilege	648	powershell.exe
Token: SeLoadDriverPrivilege	648	powershell.exe
Token: SeSystemProfilePrivilege	648	powershell.exe
Token: SeSystemtimePrivilege	648	powershell.exe
Token: SeProfSingleProcessPrivilege	648	powershell.exe
Token: SeIncBasePriorityPrivilege	648	powershell.exe
Token: SeCreatePagefilePrivilege	648	powershell.exe
Token: SeBackupPrivilege	648	powershell.exe
Token: SeRestorePrivilege	648	powershell.exe
Token: SeShutdownPrivilege	648	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeSystemEnvironmentPrivilege	648	powershell.exe
Token: SeRemoteShutdownPrivilege	648	powershell.exe
Token: SeUndockPrivilege	648	powershell.exe
Token: SeManageVolumePrivilege	648	powershell.exe
Token: 33	648	powershell.exe
Token: 34	648	powershell.exe
Token: 35	648	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4128	2896	doomstresser-c2-ddosiara.exe	82
PID 2896 wrote to memory of 648	2896	doomstresser-c2-ddosiara.exe	86
PID 2896 wrote to memory of 3784	2896	doomstresser-c2-ddosiara.exe	89
PID 2896 wrote to memory of 2404	2896	doomstresser-c2-ddosiara.exe	91
PID 2896 wrote to memory of 4616	2896	doomstresser-c2-ddosiara.exe	93
PID 2896 wrote to memory of 2432	2896	doomstresser-c2-ddosiara.exe	95
PID 2896 wrote to memory of 4364	2896	doomstresser-c2-ddosiara.exe	97
PID 2896 wrote to memory of 1076	2896	doomstresser-c2-ddosiara.exe	99
PID 2896 wrote to memory of 520	2896	doomstresser-c2-ddosiara.exe	101
PID 2896 wrote to memory of 4408	2896	doomstresser-c2-ddosiara.exe	103

C:\Users\Admin\AppData\Local\Temp\stresserka c2\doomstresser-c2-ddosiara.exe
"C:\Users\Admin\AppData\Local\Temp\stresserka c2\doomstresser-c2-ddosiara.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\stresserka c2\doomstresser-c2-ddosiara.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:520
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2a02c5c8af1d8b3e5fa559f881bd48348931cc473f0b4f7b89eb04658e17bd38
MD5 347cf417ac560d4c9f662cb7987f93b2
SHA1 a81b59ce8f8d1aff5d6be70cd57a9d0146b7be59
SHA512 b71d66f16da6064d55a68152973b85cc7270fa99ddbf40f26a9442e6f1037c147449aea0440de9d5be176cf35832b1183f6b93b827cca0f0e1c8c0a8b1b958f4
TLSH
T131219723B3DDC850CC99023A609C9C9076B6D7C780DEDF9B3EC4C211907FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 e36f8fe73aae39266ee8469c84555df9df3073b0d28becfafa463c8d86c2b163
MD5 7a4425e64c696f4650bd825e8ab7433d
SHA1 b13b2d603dbfe9c53acf48d8300ea2659eea64d8
SHA512 af43070b6c6320e3b8a685be2ab2efb0ee7339453900b86454310d26838cceb656ad6e23cb51fe6ad657e3907efae8dc4f4bf06008235f73f939b93b847474ef
TLSH
T1DD114463B79CC8A0CC89463A409C9D9176B6DBC780EADECB3EC4C114E1BF598DB201A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4cc7c1b79d1b48582d4dc27ca8c31457b9bf2441deb7914399bb9e6863f18b13
MD5 8e1fdd1b66d2fee9f6a052524d4ddca5
SHA1 0a9d0994559d1be2eecd8b0d6960540ca627bdb6
SHA512 5a5494b878b08e8515811ab7a3d68780dac7423f5562477d98249a8bedf7ec98567b7cd5d4c6967d6bc63f2d6d9b7da9a65e0eb29d4b955026b469b5b598d1f3
TLSH
T1A3119323B3DC8961CC99023A409C9DA076B2C7C7809EDE9B2EC4C205A07F899CB201A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cedfa078f79edc1335c7cde50cddf905d88f26fcf15fdb1f11cc51a6e40e3266
MD5 57894a7604ff4d00633491705eb29610
SHA1 90e1bc17b79782404c0fe6b6d5d0cc3bd1feb3d3
SHA512 15347ed5cf5177f5ae30e1ddb031104a0a0e8bf6cb4e4db9da8c87913885a60410c8071404b66c29ccde12c11a90bf07f38c4c15f9d4e1fd1450c7ac04c3a507
TLSH
T1B7115323B7DC8A61CC99423A509C9DA075B2D7C7809EDE9B6EC5C205A07F999CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nyknkkwm.skw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyknkkwm.skw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/520-67-0x000001B965550000-0x000001B96576D000-memory.dmp

Download

memory/648-5-0x000001D0F65A0000-0x000001D0F65B0000-memory.dmp

Download

memory/648-6-0x000001D0F65A0000-0x000001D0F65B0000-memory.dmp

Download

memory/648-7-0x000001D0F70C0000-0x000001D0F714A000-memory.dmp

Download

memory/648-16-0x000001D0F6540000-0x000001D0F6550000-memory.dmp

Download

memory/648-17-0x000001D0F7BD0000-0x000001D0F7C1C000-memory.dmp

Download

memory/648-18-0x000001D0F7C40000-0x000001D0F7C60000-memory.dmp

Download

memory/648-8-0x000001D0F6550000-0x000001D0F6572000-memory.dmp

Download

memory/2896-33-0x000002A648070000-0x000002A6480C0000-memory.dmp

Download

memory/2896-32-0x000002A6480F0000-0x000002A648166000-memory.dmp

Download

memory/2896-0-0x000002A62CE50000-0x000002A62CE90000-memory.dmp

Download

memory/2896-34-0x000002A6482B0000-0x000002A6482CE000-memory.dmp

Download

memory/2896-4-0x000002A647EA0000-0x000002A647EB0000-memory.dmp

Download

memory/2896-3-0x000002A648180000-0x000002A648282000-memory.dmp

Download

memory/2896-54-0x000002A62EAE0000-0x000002A62EAEA000-memory.dmp

Download

memory/2896-55-0x000002A648290000-0x000002A6482A2000-memory.dmp

Download

memory/2896-2-0x000002A648020000-0x000002A648062000-memory.dmp

Download

memory/2896-1-0x000002A647EA0000-0x000002A647EB0000-memory.dmp

Download