Analysis
- max time kernel
149s - max time network
123s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
12/09/2026, 16:57
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Umbral.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
General
- Target Umbral.exe
- Size 231KB
- Sample260912-vgcn7sck8t
- SHA256 82da6e94870960b8f186be9c854781e51d15d71fdbbed4cb86dbd732d6019fc3
- MD5 3fdbb46f4fa9d3557b94e75be7c656f2
- SHA1 13635ffaf759afb025b42187a04f5f990cbdaaa4
- SHA512 43632ddf8e1683668b6f9aeb9256a86eed5a120a1a6fe0dae3fca8e94f654e83f13e2731eb071be8273d0cfe31b6a415523f8b50e1a8a1a96905dde22f91b74c
- SSDEEP 6144:RloZM+rIkd8g+EtXHkv/iD4U9GGHdmOh/U9va6vxS2b8e1mX+i:joZtL+EP8U9GGHdmOh/U9va6vx1Qz
- TLSH T1F6346B4933B8CB17E25F8BBED5B1159F87B1F103E90AF7CE0C8895E82411B42E949A57
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1548376488280064010/Uz-gngQYHutSQPYu8W7ooiMDey-_xujCFMqW6OxwdEsWF1hqlon7mmf2CqoI5sAb9CLT
Signatures
- Detects Umbral payload 2 IoCs
resource yara_rule behavioral2/memory/4584-0-0x000001D79E8C0000-0x000001D79E900000-memory.dmp family_umbral behavioral2/memory/4584-0-0x000001D79E8C0000-0x000001D79E900000-memory.dmp family_umbral_obfuscated - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4772 wmic.exe 4772 wmic.exe 4772 wmic.exe 4772 wmic.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4584 Umbral.exe Token: SeIncreaseQuotaPrivilege 4772 wmic.exe Token: SeSecurityPrivilege 4772 wmic.exe Token: SeTakeOwnershipPrivilege 4772 wmic.exe Token: SeLoadDriverPrivilege 4772 wmic.exe Token: SeSystemProfilePrivilege 4772 wmic.exe Token: SeSystemtimePrivilege 4772 wmic.exe Token: SeProfSingleProcessPrivilege 4772 wmic.exe Token: SeIncBasePriorityPrivilege 4772 wmic.exe Token: SeCreatePagefilePrivilege 4772 wmic.exe Token: SeBackupPrivilege 4772 wmic.exe Token: SeRestorePrivilege 4772 wmic.exe Token: SeShutdownPrivilege 4772 wmic.exe Token: SeDebugPrivilege 4772 wmic.exe Token: SeSystemEnvironmentPrivilege 4772 wmic.exe Token: SeRemoteShutdownPrivilege 4772 wmic.exe Token: SeUndockPrivilege 4772 wmic.exe Token: SeManageVolumePrivilege 4772 wmic.exe Token: 33 4772 wmic.exe Token: 34 4772 wmic.exe Token: 35 4772 wmic.exe Token: 36 4772 wmic.exe Token: SeIncreaseQuotaPrivilege 4772 wmic.exe Token: SeSecurityPrivilege 4772 wmic.exe Token: SeTakeOwnershipPrivilege 4772 wmic.exe Token: SeLoadDriverPrivilege 4772 wmic.exe Token: SeSystemProfilePrivilege 4772 wmic.exe Token: SeSystemtimePrivilege 4772 wmic.exe Token: SeProfSingleProcessPrivilege 4772 wmic.exe Token: SeIncBasePriorityPrivilege 4772 wmic.exe Token: SeCreatePagefilePrivilege 4772 wmic.exe Token: SeBackupPrivilege 4772 wmic.exe Token: SeRestorePrivilege 4772 wmic.exe Token: SeShutdownPrivilege 4772 wmic.exe Token: SeDebugPrivilege 4772 wmic.exe Token: SeSystemEnvironmentPrivilege 4772 wmic.exe Token: SeRemoteShutdownPrivilege 4772 wmic.exe Token: SeUndockPrivilege 4772 wmic.exe Token: SeManageVolumePrivilege 4772 wmic.exe Token: 33 4772 wmic.exe Token: 34 4772 wmic.exe Token: 35 4772 wmic.exe Token: 36 4772 wmic.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4584 wrote to memory of 4772 4584 Umbral.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv DEHEXIjUYkWVc7kJOljeqw.01⤵PID:4072