Analysis
- user interaction
yes - max time kernel
36s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/09/2026, 09:26
General
- Target Umbral.exe
- Size 230KB
- Sample260909-len5savwfs
- SHA256 f375faf6e798218146b86196c36cbd49c18f334501ea566b94758081dae6e6c6
Score
10/10
Malware Config
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discordapp.com/api/webhooks/1547172295263522920/5GXH_4WvQ9gSuValuXOqToRu5-wevAZRCL9D3FFuQdc0N4-JzgDMrEfh4JgX7Vkbo6lq
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4836-0-0x000001530C450000-0x000001530C490000-memory.dmp
memory/4836-1-0x0000015327250000-0x0000015327260000-memory.dmp
memory/4836-2-0x0000015327250000-0x0000015327260000-memory.dmp