umbral | 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c

Analysis

user interaction
yes
max time kernel
46s
max time network
47s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.1MB
Sample260901-3krxasfc76
SHA256 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c
MD5 c525491a369b3d926183c5ed3533a5d9
SHA1 365a5301bab12a7512d636a415c3fca3cf568e3d
SHA512 5e73fbf150cd593a64fb3656dfab157bbafefe3aaa1cae71cf6b5f4b6ebd3c585ff184c82165936256134d06b220c6f22b91e83caf8d2eb3cfa0f2f420620439
SSDEEP 24576:NpbdQQqZl8nmoiCqOKGnTpPs9xYo3wxoVrHUgZ:rR5qZ6m0nTpPsPy+jr
TLSH
T1583512CCB52472EED957C032CAD85C68AA50BC77831B5607A8AB106DAD4DCC7DF291F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution umbral persistence spyware stealer

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2548-24-0x000001B282800000-0x000001B282878000-memory.dmp	disable_win_def
behavioral2/files/0x001f00000002b3c2-23.dat	disable_win_def

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral2/memory/2548-24-0x000001B282800000-0x000001B282878000-memory.dmp	family_umbral
behavioral2/memory/2548-24-0x000001B282800000-0x000001B282878000-memory.dmp	family_umbral_obfuscated
behavioral2/files/0x001f00000002b3c2-23.dat	family_umbral
behavioral2/files/0x001f00000002b3c2-23.dat	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2444	powershell.exe
4280	powershell.exe
4912	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4280	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4280	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3812	affe_loader.exe
2548	RuntimeBroker.exe
1328	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooe4aH3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe\""	RuntimeBroker.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/3864-0-0x00000000002E0000-0x0000000000404000-memory.dmp	ConfuserEx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3324	schtasks.exe
1552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	powershell.exe
3176	powershell.exe
2444	powershell.exe
2444	powershell.exe
4280	powershell.exe
4280	powershell.exe
4912	powershell.exe
4912	powershell.exe
1548	powershell.exe
1548	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3812	affe_loader.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeSecurityPrivilege	2484	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3812	affe_loader.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3176	3864	Loader.exe	80
PID 3864 wrote to memory of 3812	3864	Loader.exe	82
PID 3864 wrote to memory of 2548	3864	Loader.exe	83
PID 2548 wrote to memory of 2444	2548	RuntimeBroker.exe	84
PID 2548 wrote to memory of 4280	2548	RuntimeBroker.exe	86
PID 2548 wrote to memory of 1552	2548	RuntimeBroker.exe	88
PID 2548 wrote to memory of 3324	2548	RuntimeBroker.exe	90
PID 2548 wrote to memory of 4912	2548	RuntimeBroker.exe	94
PID 2548 wrote to memory of 1548	2548	RuntimeBroker.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAeABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAaABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAZAB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAaAB1ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3176
- C:\Users\Admin\AppData\Roaming\affe_loader.exe
  "C:\Users\Admin\AppData\Roaming\affe_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3812
- C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "cooe4aH3" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1552
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "cooe4aH3_svc" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc minute /mo 5 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:1328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34e44060ab82aa2a3f7007afad1fd907e1a319b26e3e7061cefbfb001d5021ae
MD5 3d6e3b64f994978b94fc50a5b2985f9d
SHA1 dac0218a14cdbfcd871b6b24ad370c9ed5304421
SHA512 1488bb2391d7e8be284ed07c57deb6628e93d650dc8959b49f220ff17a6ef04975b10f4ef2b2b39e57b638b0e91d572d79caccd6f9d45ed572ab8955375532cf
TLSH
T12B117A33B79CC134C8D9157A1088AD11B1B1C3CB049EDE8F7B84C109E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ceceebdbd877d161f925e88d1983f280ddd0d9f053aedb0933a4ce9b0e87d56e
MD5 74b36cdea857534f335ca01cf989c95d
SHA1 17e64556a910c99db09300818cf3244a0ffd0fc9
SHA512 a608fb113e4a11c2a5ace3fe9f5e589bfae960b2fba4fa10c9ca0ab7453e3d8cbbd62b0a9a42ee43154ab359aafdb68e3c3445d7f7e7a1531152bab96366bfae
TLSH
T1A6218633B7ACC235C8D911BA208CAD11B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 4e3995f19dfbc9d52d06710d160df9b09c6a8de45e111db789ef728381934aad
MD5 8700d7bcbc41eae6174d627b25ce4763
SHA1 cde0b90922ae582d3b2de55de3584699b25f0dab
SHA512 8e322b5207a15cdbcc3c029cdaa3b2a85b2e980f779eb093117dcf8fd51589faf58dd3866df1796b03856427bef5e5c239d7ffd24c8d9320a1ae36ec69bf77bc
TLSH
T13D114433B78CC068C985167A1088AE01B2B583CB009EDD8B7A84C504E5BF98AEB942B4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eszznncm.k5p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eszznncm.k5p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
Size 458KB
SHA256 059344941a9b0949c40ed3c0aafc6d3d4fee8de37c638be8d59c2a0156f79d91
MD5 b6114f51453005dc6fd7c49925ebaf1c
SHA1 355ccc27beae8e50c3ea00e72560af019f17bf5e
SHA512 6f6d1fc9063cd6247f7dd206eb1889b47b1db1676c833091da6a04df43342c848f525cb43968d3be922f06c266c5ec7d74f2a5fba6ce4342a7c675a80e77158d
SSDEEP 6144:pANDNvB4JAVSGuZDZAIuIW9pNnJznCGJ98beB/0XDGNTQy4R:pAHcGuZDZMDB/iy
TLSH
T194A44A9057F8D942F1BF5BB4747019AE8B73F603E9A9F74E068C41D80AA3B42D940B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

affe_loader.exe

Path C:\Users\Admin\AppData\Roaming\affe_loader.exe
Size 599KB
SHA256 e2a4bf39121b8e6c1aa71510297e40d7a008301d53f2209d302f1fd6e072d9b5
MD5 fd5685408b0fa1c4f1d5ebb8c276f7fc
SHA1 a6bc1de115ddecc7d446b4d55cc0d2d0e0d6f1dc
SHA512 4c4d4215af7955db30eb3da76504ffcd60dbe9345172409afb13fd68b8bc7972a3a6a033253e577871b1864c6cf54d98cc56bfb3fee64cb5d0cc52fc1741cba6
SSDEEP 12288:ypvrHIGev7yaY0stSpUtqSBAq/aPViYOSHYisn4903JLxdZ:2rHIXrOvA+adie4isnf3lx
TLSH
T1A8D4BF86B2F441F8D03BD239D695A61BFA76344417208ADB13E4455A3FA33E05BBF722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-55-0x00000159F4D20000-0x00000159F4D2A000-memory.dmp

Download

memory/2444-59-0x00000159F4FC0000-0x00000159F4FCA000-memory.dmp

Download

memory/2444-58-0x00000159F4FB0000-0x00000159F4FB6000-memory.dmp

Download

memory/2444-57-0x00000159F4D30000-0x00000159F4D38000-memory.dmp

Download

memory/2548-24-0x000001B282800000-0x000001B282878000-memory.dmp

Download

memory/2548-76-0x000001B29CF30000-0x000001B29CFA6000-memory.dmp

Download

memory/2548-78-0x000001B29CEB0000-0x000001B29CECE000-memory.dmp

Download

memory/2548-77-0x000001B29CFB0000-0x000001B29D000000-memory.dmp

Download

memory/3176-56-0x000001F436A40000-0x000001F436A5A000-memory.dmp

Download

memory/3176-45-0x000001F4366A0000-0x000001F4366BC000-memory.dmp

Download

memory/3176-31-0x000001F4363F0000-0x000001F436412000-memory.dmp

Download

memory/3176-19-0x000001F41CAE0000-0x000001F41CAF0000-memory.dmp

Download

memory/3176-20-0x000001F41CAE0000-0x000001F41CAF0000-memory.dmp

Download

memory/3176-53-0x000001F436780000-0x000001F43678A000-memory.dmp

Download

memory/3176-46-0x000001F4366C0000-0x000001F436773000-memory.dmp

Download

memory/3176-54-0x000001F436900000-0x000001F43691C000-memory.dmp

Download

memory/3864-0-0x00000000002E0000-0x0000000000404000-memory.dmp

Download

memory/3864-2-0x000000001C670000-0x000000001C680000-memory.dmp

Download

memory/3864-1-0x000000001C680000-0x000000001C78E000-memory.dmp

Download