Analysis
- user interaction
yes - max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 15:00
Behavioral task
behavioral1
Sample
#C.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target #C.exe
- Size 229KB
- Sample261009-sdmc5ay17k
- SHA256 a6d7c505bc952b07827d963e96e6f4cac072f440c9db6496c137638c9b73ec6e
- MD5 6c0439ead2e894e11c69b31297be7600
- SHA1 13dd53071ce18942e2c5029838a63a6451b3f5bd
- SHA512 e2a6c0ae51b74285afa4edeb9ec41ab9b4f6c6956e6a41c7270de61ec847f6f7f548ed02032b6c25178c37e272f57c1abc401236cdae132e23bc343016534939
- SSDEEP 6144:/loZPybCQeWNNjth7gDz3ah/SobxM8KDXqBVa07nIr3Tuuuxp8eFJLIEc:9oZjpWHjAa/SoVM8KDXqBVa07nIrQJEV
- TLSH T11B346B5527BCCF12E65F9FBDD5B0149F8772F103E90AF78E0D8899E81812B01E849A97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
umbral
Version
-
v1.0
C2
-
https://discord.com/api/webhooks/1558131946662531233/af3X9-6dLLSKphBZVYzscidviiZ50eRBwb2IKblwAVRgGoo0C1k8KIJb-YBVmwWvozUO
Signatures
- Detects Umbral payload 2 IoCs
resource yara_rule behavioral2/memory/2928-0-0x000001AFE7940000-0x000001AFE7980000-memory.dmp family_umbral behavioral2/memory/2928-0-0x000001AFE7940000-0x000001AFE7980000-memory.dmp family_umbral_obfuscated - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 5256 wmic.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain #C.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname #C.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5256 wmic.exe 5256 wmic.exe 5256 wmic.exe 5256 wmic.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1484 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2928 #C.exe Token: SeIncreaseQuotaPrivilege 5256 wmic.exe Token: SeSecurityPrivilege 5256 wmic.exe Token: SeTakeOwnershipPrivilege 5256 wmic.exe Token: SeLoadDriverPrivilege 5256 wmic.exe Token: SeSystemProfilePrivilege 5256 wmic.exe Token: SeSystemtimePrivilege 5256 wmic.exe Token: SeProfSingleProcessPrivilege 5256 wmic.exe Token: SeIncBasePriorityPrivilege 5256 wmic.exe Token: SeCreatePagefilePrivilege 5256 wmic.exe Token: SeBackupPrivilege 5256 wmic.exe Token: SeRestorePrivilege 5256 wmic.exe Token: SeShutdownPrivilege 5256 wmic.exe Token: SeDebugPrivilege 5256 wmic.exe Token: SeSystemEnvironmentPrivilege 5256 wmic.exe Token: SeRemoteShutdownPrivilege 5256 wmic.exe Token: SeUndockPrivilege 5256 wmic.exe Token: SeManageVolumePrivilege 5256 wmic.exe Token: 33 5256 wmic.exe Token: 34 5256 wmic.exe Token: 35 5256 wmic.exe Token: 36 5256 wmic.exe Token: SeIncreaseQuotaPrivilege 5256 wmic.exe Token: SeSecurityPrivilege 5256 wmic.exe Token: SeTakeOwnershipPrivilege 5256 wmic.exe Token: SeLoadDriverPrivilege 5256 wmic.exe Token: SeSystemProfilePrivilege 5256 wmic.exe Token: SeSystemtimePrivilege 5256 wmic.exe Token: SeProfSingleProcessPrivilege 5256 wmic.exe Token: SeIncBasePriorityPrivilege 5256 wmic.exe Token: SeCreatePagefilePrivilege 5256 wmic.exe Token: SeBackupPrivilege 5256 wmic.exe Token: SeRestorePrivilege 5256 wmic.exe Token: SeShutdownPrivilege 5256 wmic.exe Token: SeDebugPrivilege 5256 wmic.exe Token: SeSystemEnvironmentPrivilege 5256 wmic.exe Token: SeRemoteShutdownPrivilege 5256 wmic.exe Token: SeUndockPrivilege 5256 wmic.exe Token: SeManageVolumePrivilege 5256 wmic.exe Token: 33 5256 wmic.exe Token: 34 5256 wmic.exe Token: 35 5256 wmic.exe Token: 36 5256 wmic.exe Token: SeDebugPrivilege 1484 taskmgr.exe Token: SeSystemProfilePrivilege 1484 taskmgr.exe Token: SeCreateGlobalPrivilege 1484 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe 1484 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1484 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2928 wrote to memory of 5256 2928 #C.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\#C.exe"C:\Users\Admin\AppData\Local\Temp\#C.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5256
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1556