umbral | 1e50dbf077409eb0a7c98c46e737c2bb7c9c524df7ea6e3f2035cd278d86e60a

Analysis

user interaction
yes
max time kernel
33s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dras.exe
Size 1.0MB
Sample261027-w7pxwsec47
SHA256 1e50dbf077409eb0a7c98c46e737c2bb7c9c524df7ea6e3f2035cd278d86e60a
MD5 9f2726ce830906610a0da20a4e28d8a5
SHA1 e3a1ebd345a85c02840af366a9818cb13d17d6cd
SHA512 5f5e8d0511ff68f29f6c0b0866eff16e4e55d79a6a05a9f32d945705a1850cc88578209520467a7936829b3b5e5185c003367a582ae2f6840acc96b3f336d87c
SSDEEP 24576:5MiLPxQYBu9TrQGmpffJfDP4vgFGQK/BStKGiI8JvtZNANAkicW12Sk0iZBU5oBl:5QhunJfcvWK/BS1rNMcWk0iZBEoBSj4
TLSH
T1553501B8775EA1B3D8B485315A30F0B6389BFCBF9E0C74599245BF85207510F163A3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery umbral stealer

Malware Config

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1564707663202492429/WfkrufsqxSdh7yE9rCek4gWDL3wqpZJEb6SfWVLQ-mQ2TvvLxQgHvQVeXxuYbuvOT8mR

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011370-7.dat	family_umbral
behavioral2/files/0x0009000000011370-7.dat	family_umbral_obfuscated
behavioral2/memory/4692-17-0x000001FFEC020000-0x000001FFEC060000-memory.dmp	family_umbral
behavioral2/memory/4692-17-0x000001FFEC020000-0x000001FFEC060000-memory.dmp	family_umbral_obfuscated

Executes dropped EXE 7 IoCs

pid	Process
4692	fdew.exe
5740	inras.exe
2792	bras.exe
2584	fdew.exe
5224	fdew.exe
2856	inras.exe
5552	fdew.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ip-api.com

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4688	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fdew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fdew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4688	wmic.exe
4688	wmic.exe
4688	wmic.exe
4688	wmic.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	fdew.exe
Token: SeIncreaseQuotaPrivilege	4688	wmic.exe
Token: SeSecurityPrivilege	4688	wmic.exe
Token: SeTakeOwnershipPrivilege	4688	wmic.exe
Token: SeLoadDriverPrivilege	4688	wmic.exe
Token: SeSystemProfilePrivilege	4688	wmic.exe
Token: SeSystemtimePrivilege	4688	wmic.exe
Token: SeProfSingleProcessPrivilege	4688	wmic.exe
Token: SeIncBasePriorityPrivilege	4688	wmic.exe
Token: SeCreatePagefilePrivilege	4688	wmic.exe
Token: SeBackupPrivilege	4688	wmic.exe
Token: SeRestorePrivilege	4688	wmic.exe
Token: SeShutdownPrivilege	4688	wmic.exe
Token: SeDebugPrivilege	4688	wmic.exe
Token: SeSystemEnvironmentPrivilege	4688	wmic.exe
Token: SeRemoteShutdownPrivilege	4688	wmic.exe
Token: SeUndockPrivilege	4688	wmic.exe
Token: SeManageVolumePrivilege	4688	wmic.exe
Token: 33	4688	wmic.exe
Token: 34	4688	wmic.exe
Token: 35	4688	wmic.exe
Token: 36	4688	wmic.exe
Token: SeIncreaseQuotaPrivilege	4688	wmic.exe
Token: SeSecurityPrivilege	4688	wmic.exe
Token: SeTakeOwnershipPrivilege	4688	wmic.exe
Token: SeLoadDriverPrivilege	4688	wmic.exe
Token: SeSystemProfilePrivilege	4688	wmic.exe
Token: SeSystemtimePrivilege	4688	wmic.exe
Token: SeProfSingleProcessPrivilege	4688	wmic.exe
Token: SeIncBasePriorityPrivilege	4688	wmic.exe
Token: SeCreatePagefilePrivilege	4688	wmic.exe
Token: SeBackupPrivilege	4688	wmic.exe
Token: SeRestorePrivilege	4688	wmic.exe
Token: SeShutdownPrivilege	4688	wmic.exe
Token: SeDebugPrivilege	4688	wmic.exe
Token: SeSystemEnvironmentPrivilege	4688	wmic.exe
Token: SeRemoteShutdownPrivilege	4688	wmic.exe
Token: SeUndockPrivilege	4688	wmic.exe
Token: SeManageVolumePrivilege	4688	wmic.exe
Token: 33	4688	wmic.exe
Token: 34	4688	wmic.exe
Token: 35	4688	wmic.exe
Token: 36	4688	wmic.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4692	2988	dras.exe	89
PID 2988 wrote to memory of 5740	2988	dras.exe	90
PID 2988 wrote to memory of 2792	2988	dras.exe	91
PID 5740 wrote to memory of 2584	5740	inras.exe	92
PID 4692 wrote to memory of 4688	4692	fdew.exe	93
PID 2792 wrote to memory of 5224	2792	bras.exe	95
PID 2792 wrote to memory of 2856	2792	bras.exe	96
PID 2856 wrote to memory of 5552	2856	inras.exe	98

C:\Users\Admin\AppData\Local\Temp\dras.exe
"C:\Users\Admin\AppData\Local\Temp\dras.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Roaming\fdew.exe
  "C:\Users\Admin\AppData\Roaming\fdew.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\Users\Admin\AppData\Roaming\inras.exe
  "C:\Users\Admin\AppData\Roaming\inras.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Users\Admin\AppData\Roaming\fdew.exe
    "C:\Users\Admin\AppData\Roaming\fdew.exe"
    3⤵
    - Executes dropped EXE
    PID:2584
- C:\Users\Admin\AppData\Roaming\bras.exe
  "C:\Users\Admin\AppData\Roaming\bras.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Roaming\fdew.exe
    "C:\Users\Admin\AppData\Roaming\fdew.exe"
    3⤵
    - Executes dropped EXE
    PID:5224
- - C:\Users\Admin\AppData\Roaming\inras.exe
    "C:\Users\Admin\AppData\Roaming\inras.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Users\Admin\AppData\Roaming\fdew.exe
      "C:\Users\Admin\AppData\Roaming\fdew.exe"
      4⤵
      Executes dropped EXE
      PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bras.exe

Path C:\Users\Admin\AppData\Roaming\bras.exe
Size 535KB
SHA256 341461edd61d5da74167ffcfdfb661a4673b91604ed19f237f70bf54e83ac7a7
MD5 14189b30e7426ff88228123608a18985
SHA1 f2e293573ced58da1e88877eb048a42e13f86e52
SHA512 84021d79d26da8d9f712c913d004d553d00325d318661ac5b53da9da03a920ef7131089ebb558b67f1ca7ae92f1c81a6b3a2f94dffd97a90f3addbc6a0b1583a
SSDEEP 12288:hUiDAlMr7N52QcnzJRx+9aFDhw/PtmLDrhxabEwUfz1:hvDAlk52bnzJSwFDhqP4LD+EwUL1
TLSH
T145C4F16A83468DAFD4FA84B3F5512A2076DD2F40EB11F926778476D2013EC3E6053A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdew.exe

Path C:\Users\Admin\AppData\Roaming\fdew.exe
Size 229KB
SHA256 cbbabc687bf222b4b1693e9d1b0700158d6e7f6d766ad9c96f09fae297514e68
MD5 2a5e44c39420ad49e0f0f4aad7d41f8e
SHA1 45dd63cf019a5872a7db94504b391988cc19c52f
SHA512 5dad3a813b23e24dee7d15982411c04003e644bd8ef498257fcee7fc60c48bf4a9735332921b3377f25f6aa85cf204b5605123904c63f5dbfb94075115e50c28
SSDEEP 6144:lloZM+rIkd8g+EtXHkv/iD4OUgxecjfUg1gevPe4sb8e1mji:noZtL+EP8OUgxecjfUg1gevPe9l
TLSH
T16B346B5933B88B17E25F8BBDD5B1149F87B1F103E90AF78E0C8895F82412B42E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inras.exe

Path C:\Users\Admin\AppData\Roaming\inras.exe
Size 268KB
SHA256 40ae2643742b8ef7fe5ecbf1d5e026570b2f75ef715e25137ed2ffef3ccd5722
MD5 7aadbed0d2a9a7c95bcf8a766ea877e6
SHA1 96507b659a5300d49b23be4175b5416464dc3083
SHA512 2994bd645000737b10eff115cd3916afebf2affe53fc4fe6a610a097f40a19871dd33c448052a99ad7ebf3071a5da74b1f6177feea1fb34069e5e1430f5dbe11
SSDEEP 6144:Yo9rnLoLjqEH1K01Ao52OLkEhvroF8+6q0Lsnna42Rc8zp0xq:JoLjqEHV1Ao4OLkEhUF0Qna4qP+M
TLSH
T1104412E0A7A491E7D6FB1AB1DE20645070EA5D1673F7F50F82C439AA9B3710D49230E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2792-32-0x0000000000210000-0x000000000029C000-memory.dmp

Download

memory/2988-33-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/2988-1-0x0000000000CB0000-0x0000000000DC2000-memory.dmp

Download

memory/2988-18-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/2988-4-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/2988-0-0x00007FFE69F8F000-0x00007FFE69F90000-memory.dmp

Download

memory/2988-3-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/2988-28-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4692-35-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4692-34-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4692-17-0x000001FFEC020000-0x000001FFEC060000-memory.dmp

Download

memory/4692-38-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4692-37-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4692-45-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4692-50-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/5740-27-0x00000000007B0000-0x00000000007FA000-memory.dmp

Download