Analysis
- user interaction
yes - max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 15:00
Behavioral task
behavioral1
Sample
#C.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target #C.exe
- Size 229KB
- Sample261009-sdmc5ay17k
- SHA256 a6d7c505bc952b07827d963e96e6f4cac072f440c9db6496c137638c9b73ec6e
- MD5 6c0439ead2e894e11c69b31297be7600
- SHA1 13dd53071ce18942e2c5029838a63a6451b3f5bd
- SHA512 e2a6c0ae51b74285afa4edeb9ec41ab9b4f6c6956e6a41c7270de61ec847f6f7f548ed02032b6c25178c37e272f57c1abc401236cdae132e23bc343016534939
- SSDEEP 6144:/loZPybCQeWNNjth7gDz3ah/SobxM8KDXqBVa07nIr3Tuuuxp8eFJLIEc:9oZjpWHjAa/SoVM8KDXqBVa07nIrQJEV
- TLSH T11B346B5527BCCF12E65F9FBDD5B0149F8772F103E90AF78E0D8899E81812B01E849A97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
umbral
Version
-
v1.0
C2
-
https://discord.com/api/webhooks/1558131946662531233/af3X9-6dLLSKphBZVYzscidviiZ50eRBwb2IKblwAVRgGoo0C1k8KIJb-YBVmwWvozUO
Signatures
- Detects Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/4256-0-0x0000016D03DF0000-0x0000016D03E30000-memory.dmp family_umbral behavioral1/memory/4256-0-0x0000016D03DF0000-0x0000016D03E30000-memory.dmp family_umbral_obfuscated - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 2856 wmic.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain #C.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname #C.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4664 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 4256 #C.exe Token: SeIncreaseQuotaPrivilege 2856 wmic.exe Token: SeSecurityPrivilege 2856 wmic.exe Token: SeTakeOwnershipPrivilege 2856 wmic.exe Token: SeLoadDriverPrivilege 2856 wmic.exe Token: SeSystemProfilePrivilege 2856 wmic.exe Token: SeSystemtimePrivilege 2856 wmic.exe Token: SeProfSingleProcessPrivilege 2856 wmic.exe Token: SeIncBasePriorityPrivilege 2856 wmic.exe Token: SeCreatePagefilePrivilege 2856 wmic.exe Token: SeBackupPrivilege 2856 wmic.exe Token: SeRestorePrivilege 2856 wmic.exe Token: SeShutdownPrivilege 2856 wmic.exe Token: SeDebugPrivilege 2856 wmic.exe Token: SeSystemEnvironmentPrivilege 2856 wmic.exe Token: SeRemoteShutdownPrivilege 2856 wmic.exe Token: SeUndockPrivilege 2856 wmic.exe Token: SeManageVolumePrivilege 2856 wmic.exe Token: 33 2856 wmic.exe Token: 34 2856 wmic.exe Token: 35 2856 wmic.exe Token: 36 2856 wmic.exe Token: SeIncreaseQuotaPrivilege 2856 wmic.exe Token: SeSecurityPrivilege 2856 wmic.exe Token: SeTakeOwnershipPrivilege 2856 wmic.exe Token: SeLoadDriverPrivilege 2856 wmic.exe Token: SeSystemProfilePrivilege 2856 wmic.exe Token: SeSystemtimePrivilege 2856 wmic.exe Token: SeProfSingleProcessPrivilege 2856 wmic.exe Token: SeIncBasePriorityPrivilege 2856 wmic.exe Token: SeCreatePagefilePrivilege 2856 wmic.exe Token: SeBackupPrivilege 2856 wmic.exe Token: SeRestorePrivilege 2856 wmic.exe Token: SeShutdownPrivilege 2856 wmic.exe Token: SeDebugPrivilege 2856 wmic.exe Token: SeSystemEnvironmentPrivilege 2856 wmic.exe Token: SeRemoteShutdownPrivilege 2856 wmic.exe Token: SeUndockPrivilege 2856 wmic.exe Token: SeManageVolumePrivilege 2856 wmic.exe Token: 33 2856 wmic.exe Token: 34 2856 wmic.exe Token: 35 2856 wmic.exe Token: 36 2856 wmic.exe Token: SeDebugPrivilege 4664 taskmgr.exe Token: SeSystemProfilePrivilege 4664 taskmgr.exe Token: SeCreateGlobalPrivilege 4664 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe 4664 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4256 wrote to memory of 2856 4256 #C.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\#C.exe"C:\Users\Admin\AppData\Local\Temp\#C.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4664