Analysis
- user interaction
yes - max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 13:49
Behavioral task
behavioral1
Sample
dews.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target dews.exe
- Size 230KB
- Sample261026-q44c8aes9x
- SHA256 7d7fa738f0f42de0ac33b1990c028d536df6b5c2a8459ca957c25292448db97b
- MD5 4f7fae9f1c99261a1f7993bb82968219
- SHA1 0f56c6382527d73aa2a97032a8ffbe7e35065f6f
- SHA512 cfeb29e9877dbf852748c1425b238682b5a40dacea37f9cf25f9a7f3fd55801f85d8369928d37b958dba13aca6a17431f114eccb037dc12fe03951150e37559a
- SSDEEP 6144:9loZM+rIkd8g+EtXHkv/iD4t+CzhS+JEk1jWW7U9gmp8e1mRMi:foZtL+EP8t+CzhS+JEk1jWW7gcF
- TLSH T1AD347D5437B8DB12E62F8FBED5B1549F8B72F103E90AF78E0C8895E82811741E909E57
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1564274618951532574/sk8MoJltzk5FNoa9Clm8gDI4mhCSVQHvUv6V8xhgPBupBII6JQKqyK9rtV-dnPk7cnGF
Signatures
- Detects Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/5564-0-0x00000217D95A0000-0x00000217D95E0000-memory.dmp family_umbral behavioral1/memory/5564-0-0x00000217D95A0000-0x00000217D95E0000-memory.dmp family_umbral_obfuscated - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 3096 wmic.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dews.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dews.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 5564 dews.exe Token: SeIncreaseQuotaPrivilege 3096 wmic.exe Token: SeSecurityPrivilege 3096 wmic.exe Token: SeTakeOwnershipPrivilege 3096 wmic.exe Token: SeLoadDriverPrivilege 3096 wmic.exe Token: SeSystemProfilePrivilege 3096 wmic.exe Token: SeSystemtimePrivilege 3096 wmic.exe Token: SeProfSingleProcessPrivilege 3096 wmic.exe Token: SeIncBasePriorityPrivilege 3096 wmic.exe Token: SeCreatePagefilePrivilege 3096 wmic.exe Token: SeBackupPrivilege 3096 wmic.exe Token: SeRestorePrivilege 3096 wmic.exe Token: SeShutdownPrivilege 3096 wmic.exe Token: SeDebugPrivilege 3096 wmic.exe Token: SeSystemEnvironmentPrivilege 3096 wmic.exe Token: SeRemoteShutdownPrivilege 3096 wmic.exe Token: SeUndockPrivilege 3096 wmic.exe Token: SeManageVolumePrivilege 3096 wmic.exe Token: 33 3096 wmic.exe Token: 34 3096 wmic.exe Token: 35 3096 wmic.exe Token: 36 3096 wmic.exe Token: SeIncreaseQuotaPrivilege 3096 wmic.exe Token: SeSecurityPrivilege 3096 wmic.exe Token: SeTakeOwnershipPrivilege 3096 wmic.exe Token: SeLoadDriverPrivilege 3096 wmic.exe Token: SeSystemProfilePrivilege 3096 wmic.exe Token: SeSystemtimePrivilege 3096 wmic.exe Token: SeProfSingleProcessPrivilege 3096 wmic.exe Token: SeIncBasePriorityPrivilege 3096 wmic.exe Token: SeCreatePagefilePrivilege 3096 wmic.exe Token: SeBackupPrivilege 3096 wmic.exe Token: SeRestorePrivilege 3096 wmic.exe Token: SeShutdownPrivilege 3096 wmic.exe Token: SeDebugPrivilege 3096 wmic.exe Token: SeSystemEnvironmentPrivilege 3096 wmic.exe Token: SeRemoteShutdownPrivilege 3096 wmic.exe Token: SeUndockPrivilege 3096 wmic.exe Token: SeManageVolumePrivilege 3096 wmic.exe Token: 33 3096 wmic.exe Token: 34 3096 wmic.exe Token: 35 3096 wmic.exe Token: 36 3096 wmic.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5564 wrote to memory of 3096 5564 dews.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\dews.exe"C:\Users\Admin\AppData\Local\Temp\dews.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3096
-