umbral | e92b6feab77370f9d17f583a0e3757c00c05a9ba400587e92c292771cf1986d0

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#C.exe
Size 229KB
Sample261009-sd558sy17p
SHA256 e92b6feab77370f9d17f583a0e3757c00c05a9ba400587e92c292771cf1986d0
MD5 d64406eca3c8ba5e5967ed4c7c8d8013
SHA1 cefc12c22c4e737d2e60e8326728973ce4fa13cb
SHA512 b0ef6ecb0068886defada783dc011a33a72fad651530292c2d9a5d0eeab13f9148ddde63c178549d16fd1ee7a0c8d64c5168f84b95d00f79d44c35bdd41be104
SSDEEP 6144:/loZwybCQeWNNjth7gDz3ah/SobxM8KDXqBVa07nIr3Tuuuxp8eFJL3c:9oZ4pWHjAa/SoVM8KDXqBVa07nIrQJY
TLSH
T1DB346C5527BCCF16E65F9FBDD5B0148F8772F103E90AF78E0D8899E81812B01E849A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution umbral spyware stealer

Malware Config

Extracted

Family

umbral

Version

v1.0

https://discord.com/api/webhooks/1558131946662531233/af3X9-6dLLSKphBZVYzscidviiZ50eRBwb2IKblwAVRgGoo0C1k8KIJb-YBVmwWvozUO

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 2 IoCs

resource	yara_rule
behavioral2/memory/2976-0-0x000001E5045F0000-0x000001E504630000-memory.dmp	family_umbral
behavioral2/memory/2976-0-0x000001E5045F0000-0x000001E504630000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4860	powershell.exe
5852	powershell.exe
4236	powershell.exe
4256	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5852	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	#C.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5852	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2460	wmic.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	#C.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	#C.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
812	wmic.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
5852	powershell.exe
5852	powershell.exe
5852	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
1536	powershell.exe
1536	powershell.exe
1536	powershell.exe
2076	wmic.exe
2076	wmic.exe
2076	wmic.exe
2076	wmic.exe
1764	wmic.exe
1764	wmic.exe
1764	wmic.exe
1764	wmic.exe
2460	wmic.exe
2460	wmic.exe
2460	wmic.exe
2460	wmic.exe
4256	powershell.exe
4256	powershell.exe
4256	powershell.exe
812	wmic.exe
812	wmic.exe
812	wmic.exe
812	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	#C.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeIncreaseQuotaPrivilege	4860	powershell.exe
Token: SeSecurityPrivilege	4860	powershell.exe
Token: SeTakeOwnershipPrivilege	4860	powershell.exe
Token: SeLoadDriverPrivilege	4860	powershell.exe
Token: SeSystemProfilePrivilege	4860	powershell.exe
Token: SeSystemtimePrivilege	4860	powershell.exe
Token: SeProfSingleProcessPrivilege	4860	powershell.exe
Token: SeIncBasePriorityPrivilege	4860	powershell.exe
Token: SeCreatePagefilePrivilege	4860	powershell.exe
Token: SeBackupPrivilege	4860	powershell.exe
Token: SeRestorePrivilege	4860	powershell.exe
Token: SeShutdownPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeSystemEnvironmentPrivilege	4860	powershell.exe
Token: SeRemoteShutdownPrivilege	4860	powershell.exe
Token: SeUndockPrivilege	4860	powershell.exe
Token: SeManageVolumePrivilege	4860	powershell.exe
Token: 33	4860	powershell.exe
Token: 34	4860	powershell.exe
Token: 35	4860	powershell.exe
Token: 36	4860	powershell.exe
Token: SeDebugPrivilege	5852	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	2076	wmic.exe
Token: SeSecurityPrivilege	2076	wmic.exe
Token: SeTakeOwnershipPrivilege	2076	wmic.exe
Token: SeLoadDriverPrivilege	2076	wmic.exe
Token: SeSystemProfilePrivilege	2076	wmic.exe
Token: SeSystemtimePrivilege	2076	wmic.exe
Token: SeProfSingleProcessPrivilege	2076	wmic.exe
Token: SeIncBasePriorityPrivilege	2076	wmic.exe
Token: SeCreatePagefilePrivilege	2076	wmic.exe
Token: SeBackupPrivilege	2076	wmic.exe
Token: SeRestorePrivilege	2076	wmic.exe
Token: SeShutdownPrivilege	2076	wmic.exe
Token: SeDebugPrivilege	2076	wmic.exe
Token: SeSystemEnvironmentPrivilege	2076	wmic.exe
Token: SeRemoteShutdownPrivilege	2076	wmic.exe
Token: SeUndockPrivilege	2076	wmic.exe
Token: SeManageVolumePrivilege	2076	wmic.exe
Token: 33	2076	wmic.exe
Token: 34	2076	wmic.exe
Token: 35	2076	wmic.exe
Token: 36	2076	wmic.exe
Token: SeIncreaseQuotaPrivilege	2076	wmic.exe
Token: SeSecurityPrivilege	2076	wmic.exe
Token: SeTakeOwnershipPrivilege	2076	wmic.exe
Token: SeLoadDriverPrivilege	2076	wmic.exe
Token: SeSystemProfilePrivilege	2076	wmic.exe
Token: SeSystemtimePrivilege	2076	wmic.exe
Token: SeProfSingleProcessPrivilege	2076	wmic.exe
Token: SeIncBasePriorityPrivilege	2076	wmic.exe
Token: SeCreatePagefilePrivilege	2076	wmic.exe
Token: SeBackupPrivilege	2076	wmic.exe
Token: SeRestorePrivilege	2076	wmic.exe
Token: SeShutdownPrivilege	2076	wmic.exe
Token: SeDebugPrivilege	2076	wmic.exe
Token: SeSystemEnvironmentPrivilege	2076	wmic.exe
Token: SeRemoteShutdownPrivilege	2076	wmic.exe
Token: SeUndockPrivilege	2076	wmic.exe
Token: SeManageVolumePrivilege	2076	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4860	2976	#C.exe	88
PID 2976 wrote to memory of 5852	2976	#C.exe	91
PID 2976 wrote to memory of 4236	2976	#C.exe	93
PID 2976 wrote to memory of 1536	2976	#C.exe	95
PID 2976 wrote to memory of 2076	2976	#C.exe	97
PID 2976 wrote to memory of 1764	2976	#C.exe	100
PID 2976 wrote to memory of 2460	2976	#C.exe	102
PID 2976 wrote to memory of 4256	2976	#C.exe	104
PID 2976 wrote to memory of 812	2976	#C.exe	106

C:\Users\Admin\AppData\Local\Temp\#C.exe
"C:\Users\Admin\AppData\Local\Temp\#C.exe"
1⤵
- Drops file in Drivers directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\#C.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Queries system WMI classes for hardware identifiers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 0a246d11d3f2ba4ee76e481e9eabff77062044d0c1963c3c95385ea44d9101f4
MD5 47fd629ae4deaab90f8c32683a69cf5c
SHA1 9042dcdcd0454bc614c6011b3dc70e23cde77917
SHA512 ec449ab61c22830c7acb726fd725222b3130966468518ef01026dee62a9888c77dc133b8efc3adc3ec41f41473d2adb8689e079b492a2ce54a507478172657e8
TLSH
T1CC116633F3CC8624DC59803650DEAD1136B687CB40DECE6B7B80D154B42F689DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7f5805658d2248d205ddb3a04c1dc746b75e7f070170d6127daca2c3d5a63b7
MD5 8e92e1d086773c8c57327c6acaa8b40d
SHA1 8fd2443d0323ce40fd2000f5995c32605d360f87
SHA512 88d051c4269decc92a51716fcf8c378b723ab4388f045e178da0df3adcc5bbce137631fe85b7b4ac95d61269b9250a85e476656466e5bea1f8312ea668076ad2
TLSH
T108215333F3CC8624C89A403A50CEAC1036B687DB419ECFABBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xrjtdcec.1vi.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xrjtdcec.1vi.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1536-50-0x000001AECC660000-0x000001AECD004000-memory.dmp

Download

memory/2976-63-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-53-0x000001E51EE50000-0x000001E51EE62000-memory.dmp

Download

memory/2976-7-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-65-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-64-0x000001E5064B0000-0x000001E5064C0000-memory.dmp

Download

memory/2976-0-0x000001E5045F0000-0x000001E504630000-memory.dmp

Download

memory/2976-6-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-61-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-5-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-38-0x000001E51EE80000-0x000001E51EEF6000-memory.dmp

Download

memory/2976-4-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-8-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-52-0x000001E506490000-0x000001E50649A000-memory.dmp

Download

memory/2976-3-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-2-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/2976-39-0x000001E51EE00000-0x000001E51EE50000-memory.dmp

Download

memory/2976-1-0x00007FFB180CF000-0x00007FFB180D0000-memory.dmp

Download

memory/2976-26-0x000001E5064B0000-0x000001E5064C0000-memory.dmp

Download

memory/2976-40-0x000001E506460000-0x000001E50647E000-memory.dmp

Download

memory/4236-45-0x0000027913530000-0x0000027913ED4000-memory.dmp

Download

memory/4256-60-0x00000203AE960000-0x00000203AF304000-memory.dmp

Download

memory/4860-13-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-22-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-11-0x000001F123F30000-0x000001F123F52000-memory.dmp

Download

memory/4860-29-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-28-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-27-0x000001F12490C000-0x000001F12490D000-memory.dmp

Download

memory/4860-25-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-24-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-23-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-31-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-21-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-20-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-19-0x000001F124170000-0x000001F124B14000-memory.dmp

Download

memory/4860-18-0x000001F1240C0000-0x000001F1240CA000-memory.dmp

Download

memory/4860-16-0x000001F124110000-0x000001F12412E000-memory.dmp

Download

memory/4860-17-0x000001F13D050000-0x000001F13D102000-memory.dmp

Download

memory/4860-12-0x000001F1242FF000-0x000001F124300000-memory.dmp

Download

memory/5852-36-0x000001EC5CD70000-0x000001EC5D714000-memory.dmp

Download