Overview

overview

7

Static

static

3

mao.exe

windows10-2004-x64

7

mao.exe

windows11-21h2-x64

7

SUS.pyc

windows10-2004-x64

3

SUS.pyc

windows11-21h2-x64

3

Analysis

  • max time kernel
    899s
  • max time network
    553s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-it
  • resource tags

    arch:x64arch:x86image:win11-20260130-itlocale:it-itos:windows11-21h2-x64systemwindows
  • submitted
    24/04/2026, 16:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    mao.exe
  • Size 69.8MB
  • Sample260424-vg366afv5p
  • SHA256 d91f206067f1f5e9ec2d0d1c2b2cf57a0dd24c3d37f10ab44a0bb1f41c49d89d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 49 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mao.exe
    "C:\Users\Admin\AppData\Local\Temp\mao.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Users\Admin\AppData\Local\Temp\mao.exe
      "C:\Users\Admin\AppData\Local\Temp\mao.exe"
      2⤵
      • Loads dropped DLL
      PID:228

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\_bz2.pyd
        • Size 85KB
        • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\_ctypes.pyd
        • Size 139KB
        • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\_lzma.pyd
        • Size 157KB
        • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\_zstd.pyd
        • Size 491KB
        • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 87c8e57e1fc1bff7cf9dfff06af1bdd43a67652ba96d4c35d14e5f22bd17164f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 fdb29afc4ec3585586d8415de087d6c6993c5a1171f57dd5185389eca33ba948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 4626ba7d6181906a130cb32a965c33d8f41940b23ab2946b51da3eda3f5a1d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 8289c551e17e2648bc5384e7ce4787ebea452c10e799e6da96cec930885c7584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-fibers-l1-1-0.dll
        • Size 21KB
        • SHA256 acd898771c674e63b0f3e67d98826c93143b391ae8c58563c2da7b98475ced14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 22d8959cc8e03078e28b2140911803368993cf4750743cb5e4011fc469dc1dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-file-l1-2-0.dll
        • Size 21KB
        • SHA256 3b114c3944cb6e0c4f43d4a90248f8bf0ee0230a2096b788f2a2b3f12b59c458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-file-l2-1-0.dll
        • Size 20KB
        • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 950a9c745e331fa77a46696cc85cdc6556597428392e65689acaca3177104e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 8c0df823dc018907436f1bc964b1073f41241fb1fad633f75997b9324d311f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 c0188b846ca54fd398650af690b55d713c06b0c2570c3d2304539ec15d4667cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 7c66dee567ba583d242f87d442caf38c0ce95bb1d36cd2bd74825c44e54d9078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 4ea560dbe8a2970388fb0d738b47e65caa417a2f187e3a9827b696ce01ab41eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 68bc19911007ab92d263cb40277a6afc084ca413178ad40b919302b7bbb14b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 045bd4b41c0568fc916a21cc366da93597768d8ead45411c244cf98d605dbaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 86c8c545c8f358cbe9b822c58c6af3fe00078af0422af0e391d32270cc6d8921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 ae2b8199066cb22395180d86bdc955dc2d33a6bd8d64b61ba77573d1e78b8d70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 21KB
        • SHA256 c27e4c79489c6be0eaaf7b082792c95ff7bf8adc4f67cf65f7a1a66d03c9bb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 0a422b5f26d89e799f0e80065c5738829ac476765613198f8b142b62753b3be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 e7e3f289510fcb895b22b756f64e596a4a736bf3e7cae8e71e393680dbb80f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 96d361bad0f010b1c815cb536cebdbc9cfd1034fbabbd43b612827b2d464de60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 e03d483fba05a5a50ef3ac414b904b2ff24ffbed08908b1e7f6a9416f9711856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-synch-l1-2-0.dll
        • Size 21KB
        • SHA256 e67f6f15acae34dc5ef98de01d89466136232ded7305da22d2f0a454327ad079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 af3f19f3ae063e4fb687242391df2eda6535c7c490b38b0a6870e07c6ddace99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-timezone-l1-1-0.dll
        • Size 21KB
        • SHA256 10b56211a2de348342c0cf4bcd2c91c53a0656f9476b6c0f02af88c29f392841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 a46b6708fb8e5ee9183037a479b0896552785c598d99a8339e2a05e32ea23d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 ee81ab5e33d73561172c2effc57272daa2b8e9297d30e20884177dd964fd3137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-convert-l1-1-0.dll
        • Size 25KB
        • SHA256 69e6ae713da2e6dd587aee3f5192d72ea2a37b352b123f8462c6d60f7a1e0fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-environment-l1-1-0.dll
        • Size 21KB
        • SHA256 6a951c49959f820c55b0884fe74723aaaa302a13d93ec9c6c5db21a703af34de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 90d420f9193daddc9a577ce5f37d043de87ccd25967e2a9a57492394e62bb5ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 3bd8121250a67f5422b2ac2a3af070016ea0bd26e56ba36a81ff6665b936fdd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-locale-l1-1-0.dll
        • Size 21KB
        • SHA256 cd557478f332ab196f81d274ae433c83ddf95cc9ef7579077fc31af4dc761f58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-math-l1-1-0.dll
        • Size 29KB
        • SHA256 1a5092b4e489c89b5455258169ff25f31d5ccde589989fce64092b8d7cd9d45b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-private-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-private-l1-1-0.dll
        • Size 73KB
        • SHA256 42e7bb14603eecae1b891bda68c899404d4b06a937b5828677fd6ef2320c2d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 21a538ef083b282739fe98f078ca1ce141b0f81554fe624d363c8b4a297d158b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 25KB
        • SHA256 7300fbff1c371d248ab748a9b20484ee8204c82041e80b691abe9734353dd47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 01a2fa8bfd1bad090c0ecc227663c21b343ee843f617cd0c039da930493be901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 34837d23079efd40377722266c69c9159710b4f2805ee57968c75025e9f9b1c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 b4df98e42f93fbf94a58d1924850d58f4dc6f280207c1e2b7911cf11692f65c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\api-ms-win-crt-utility-l1-1-0.dll
        • Size 21KB
        • SHA256 30eab6b13258b545642972d2a1bd1916cd3d1ee109f6c0706bfa0d1752e2e6af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\base_library.zip
        • Size 1.3MB
        • SHA256 dae75e4ae0ca7ed50f6aaefcb254ec0e76f21fae166b54c8cf213d93cb2612ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        opus.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\opus.dll
        • Size 457KB
        • SHA256 298e2884f0654ec5f2c1c9130250e5b6659cae19b3633d8f16812031ab130d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\pyexpat.pyd
        • Size 214KB
        • SHA256 85673f29fa2f16e70fb95c1da0e53e819033a19b43964662d1e487b307d8c400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\python3.DLL
        • Size 72KB
        • SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\python314.dll
        • Size 6.4MB
        • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34042\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/228-1270-0x00007FFB78FF0000-0x00007FFB79253000-memory.dmp
        Download