5d54b4029cfc2f014b9330d7fada1b8bfc365ece7ab74800bf502a9ae3345fdf

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
noverplay_local_server.exe
Size 35.7MB
Sample260416-laeesaby5p
SHA256 5d54b4029cfc2f014b9330d7fada1b8bfc365ece7ab74800bf502a9ae3345fdf
MD5 25a51adf556647c9f40d7189e81e4085
SHA1 c3e3ced06e890cc631d95af1de9f5efd032600df
SHA512 51be23f19eeded9d28e3e7500898875e49fe59d45c6fc996a8586f7ae27ba386c96ae69bf6abbb78270a9f33aea22c3ef271db2f3976a513f520a825ab15e179
SSDEEP 786432:GXOjySpXS3C4Dtb0IWaxb1ury/DHhnIoP2:HjJoDtb9WWArkNIoP2
TLSH
T16687AD117B9E98ADD15AC474834A4A725A7170CB0B36B9FF44D486393FADAF42B3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral17/files/0x0007000000024531-4.dat	pyinstaller

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3024	2440	noverplay_local_server.exe	87
PID 2440 wrote to memory of 4004	2440	noverplay_local_server.exe	89

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3024	attrib.exe
4004	attrib.exe

C:\Users\Admin\AppData\Local\Temp\noverplay_local_server.exe
"C:\Users\Admin\AppData\Local\Temp\noverplay_local_server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Local\Temp\.mi_rt_1776331276295008600
  2⤵
  - Views/modifies file attributes
  PID:3024
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Local\Temp\.mi_rt_1776331276295008600\.sys_1776331276295008600.exe
  2⤵
  - Views/modifies file attributes
  PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.sys_1776331276295008600.exe

Path C:\Users\Admin\AppData\Local\Temp\.mi_rt_1776331276295008600\.sys_1776331276295008600.exe
Size 17.5MB
SHA256 78a3ac4cd1eeb681d65e55fc1761ee14c87de8d8699afb09140d1049c15ae006
MD5 4115d4623d7c068729a6c0b4c7629015
SHA1 2dbb46bf56382feeeed6739b9fc492a14697b74a
SHA512 854cbb46e4139b88c8b7a8767289907658a3d116b6060112483a69f4821f879dc15dcce45458ce06fd45215c0d30fe59d03acb3f228a239d6d61a2400c39cd77
SSDEEP 393216:DpNtSd5gzUL+YTzDtDfDgrc6paxizg1ury/DHRbnr0oZY:DpXS3C4Dtb0IWaxb1ury/DHhnIo
TLSH
T1D707334EBAC1ACA1C8E6D93218AB8B309071FC50931DE94ECF6C77532F875D4A636E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download