Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 05:10

General

  • Target
    0a8232f5623d6998d51c915714cba286239a341b2ea35bb9b8bda7a442791596.exe
  • Size 6.9MB
  • Sample260426-ftvm8agx2q
  • SHA256 0a8232f5623d6998d51c915714cba286239a341b2ea35bb9b8bda7a442791596
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a8232f5623d6998d51c915714cba286239a341b2ea35bb9b8bda7a442791596.exe
    "C:\Users\Admin\AppData\Local\Temp\0a8232f5623d6998d51c915714cba286239a341b2ea35bb9b8bda7a442791596.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\0a8232f5623d6998d51c915714cba286239a341b2ea35bb9b8bda7a442791596.exe
      "C:\Users\Admin\AppData\Local\Temp\0a8232f5623d6998d51c915714cba286239a341b2ea35bb9b8bda7a442791596.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2540

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCR100.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\MSVCR100.dll
        • Size 756KB
        • SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_bz2.pyd
        • Size 52KB
        • SHA256 2e0cdab46bf899f8a433d57643d909c3883f95e32ca37817bf4f9e72d84a5a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_ctypes.pyd
        • Size 83KB
        • SHA256 97c3cdef6d28ad19c0dacff15dd66f874fe73c8767d88f3bc7c0bde794d857da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _hashlib.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_hashlib.pyd
        • Size 900KB
        • SHA256 2c905f0809749f5494b2a638a8551af3d914a148d282fc3da9d68ce12d067eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_lzma.pyd
        • Size 134KB
        • SHA256 b0f6cf621c166c6585e4d6346c244da51adde42a5bbbbdd9eb89bef84b1117ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_socket.pyd
        • Size 46KB
        • SHA256 e29cc2340a9577f82c45abe6707e2817575ee02ac374f4864885410d411e6bea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ssl.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_ssl.pyd
        • Size 1.3MB
        • SHA256 7a622e57f85120cefe38f473e57b7363c8afc551a35a6e4a4677b05f5d43881b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _tkinter.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\_tkinter.pyd
        • Size 35KB
        • SHA256 67609893ae2f90a0dd99262c25526e7ec93aaaa26856c2cd37afca34ef41ae8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\base_library.zip
        • Size 717KB
        • SHA256 2bd50c38730b0e933d4d1f072fdba322623096089f055a586f68da8229dc9bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python34.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\python34.dll
        • Size 2.6MB
        • SHA256 815995b80f05b9a62964088f82c46fbc2817f4cf852bc4002ac69079f29b6b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tcl86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl86t.dll
        • Size 1.2MB
        • SHA256 aa78997768d31687b809c950e7119a51b2513027871cdd61601ba63100fc0ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        auto.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\auto.tcl
        • Size 20KB
        • SHA256 4b69936a56e34c66d3c7fbe2f78d12ac4290e41e7fe8a50e9e481e05ba1f5a68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cp1252.enc

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512 TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\http1.0\pkgIndex.tcl
        • Size 735B
        • SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
        • MD5 SHA1 SHA512 TLSH

        init.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\init.tcl
        • Size 23KB
        • SHA256 1db1580e7f9cac9533f831553036ba6acecbf5584e422f7f58d7a25ae9ea78f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\opt0.4\pkgIndex.tcl
        • Size 607B
        • SHA256 eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718
        • MD5 SHA1 SHA512 TLSH

        package.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\package.tcl
        • Size 22KB
        • SHA256 34654f5851ec90fef41721f0636975e5801c1bdcaf8d14cdcad50904d335e509
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tclIndex

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\tclIndex
        • Size 5KB
        • SHA256 abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tm.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tcl\tm.tcl
        • Size 11KB
        • SHA256 8247559e6c5aa3ad02716f3f3431fac713de563467f249901c854877953b8eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk86t.dll
        • Size 1.4MB
        • SHA256 c4b3886c1e4d1ba0a6232ad792f73e2634d06455ceb68d4bb49fc175725cfc7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        button.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\button.tcl
        • Size 19KB
        • SHA256 3e35e90ebe12829fc5766aeda07beaa230647da592cfeb3f5fd018c2e1892e78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        entry.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\entry.tcl
        • Size 16KB
        • SHA256 3cf4bd444368f938db9337f9f2156425976dba7b4a9eebeffdeffa9c025d76ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\icons.tcl
        • Size 10KB
        • SHA256 a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161
        • MD5 SHA1 SHA512 SSDEEP TLSH

        listbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\listbox.tcl
        • Size 14KB
        • SHA256 6510a18f07daa43c3d2739114d19f159b4be07dd953207149e115b9aa795dc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menu.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\menu.tcl
        • Size 37KB
        • SHA256 20c7cbe9ca72be4b3572b3a51e50badcbffc3735c14e50e82ad2c8034f1bc43b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panedwindow.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\panedwindow.tcl
        • Size 5KB
        • SHA256 4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\pkgIndex.tcl
        • Size 370B
        • SHA256 ec8c5c7aa30023554124caec8be87d8ea0ff27de63a729182c00a51dea2247b3
        • MD5 SHA1 SHA512 TLSH

        scale.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\scale.tcl
        • Size 7KB
        • SHA256 090c31cded1e846bb81d1f04d18e3400d0eaf0f4323e8497ff0feb80e7d73900
        • MD5 SHA1 SHA512 SSDEEP TLSH

        scrlbar.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\scrlbar.tcl
        • Size 12KB
        • SHA256 1b9633b649b95a05641d5a86d197612f1752466f90bef1d3d13338e330891a44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spinbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\spinbox.tcl
        • Size 14KB
        • SHA256 78dc6f17d3fb3a6112aea69f448f59b3b339add6a24ae94d6f4873b43da56f40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        text.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\text.tcl
        • Size 30KB
        • SHA256 4c65254a8b0b5e656c6537ac159046dbfe0305d3d4b171e38d4da56e2b11f5b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\tk.tcl
        • Size 22KB
        • SHA256 cbc1654273f59c00ea6c723b4c00357638b0935940f937841be1e2e58725c3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        altTheme.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\altTheme.tcl
        • Size 3KB
        • SHA256 83d9a5889205ee8eae23e262f15187eebfe19375bc6c9d464e570cd5fd1f5b2c
        • MD5 SHA1 SHA512 TLSH

        button.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\button.tcl
        • Size 2KB
        • SHA256 391b6e333d16497c4b538a7bdb5b16ef11359b6e3b508d470c6e3703488e3b4d
        • MD5 SHA1 SHA512 TLSH

        clamTheme.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\clamTheme.tcl
        • Size 4KB
        • SHA256 4cc2dc26fe379f69ce46a73abfbabeb9dd5509c41616e1d5a8395be94170c62c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classicTheme.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\classicTheme.tcl
        • Size 3KB
        • SHA256 92f7befad42820e988806601dca49719fa651c88b8767b3347b13706ee3c17f9
        • MD5 SHA1 SHA512 TLSH

        combobox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\combobox.tcl
        • Size 12KB
        • SHA256 30bb473c0471f4d015fcf4b51044a026520d53927f61f3d514ea53b8af0bcf67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cursors.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\cursors.tcl
        • Size 3KB
        • SHA256 7bdffa1c2692c5d1cf67b518f9acb32fa4b4d9936ed076f4db835943bc1a00d6
        • MD5 SHA1 SHA512 TLSH

        defaults.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\defaults.tcl
        • Size 3KB
        • SHA256 436ca9ad206f26df3b4f665ab2eb60a24bb833699172ee91f5a1adaafac9951f
        • MD5 SHA1 SHA512 TLSH

        entry.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\entry.tcl
        • Size 15KB
        • SHA256 d3e7babc44688e8539858c17fbe9995e28ea23d065b0c8c0509ac3bccadff766
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fonts.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\fonts.tcl
        • Size 5KB
        • SHA256 0337eed499ff1d7a421d353b3e8483e523b454a338147b65ab1eefd5e6280a5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menubutton.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\menubutton.tcl
        • Size 4KB
        • SHA256 8e6958fbc899baeb1942e0e56d3b8cf135409949ff249d9858c777922bafbc58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notebook.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\notebook.tcl
        • Size 5KB
        • SHA256 d1e5267cde3d7be408b4c94220f7e1833c9d452bb9ba3e194e12a5eb2f9adb80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panedwindow.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\panedwindow.tcl
        • Size 1KB
        • SHA256 ce0053d637b580170938cf552b29ae890559b98eb28038c2f0a23a265ddeb273
        • MD5 SHA1 SHA512 TLSH

        progress.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\progress.tcl
        • Size 1KB
        • SHA256 a9c34f595e547ce94ee65e27c415195d2b210653a9ffcfb39559c5e0fa9c06f8
        • MD5 SHA1 SHA512 TLSH

        scale.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\scale.tcl
        • Size 2KB
        • SHA256 25d0fe2b415292872ef7acdb2dfa12d04c080b7f9b1c61f28c81aa2236180479
        • MD5 SHA1 SHA512 TLSH

        scrollbar.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\scrollbar.tcl
        • Size 3KB
        • SHA256 5932043286a30a3cffb2b6ce68ccdb9172a718f32926e25d3a962ae63cad515c
        • MD5 SHA1 SHA512 TLSH

        sizegrip.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\sizegrip.tcl
        • Size 2KB
        • SHA256 ed31fa0b0d3438acad3384dde1e562033e0d9a035e5056322da219d6c4cbd912
        • MD5 SHA1 SHA512 TLSH

        spinbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\spinbox.tcl
        • Size 4KB
        • SHA256 51f8a6c772648541684b48622ffe41b77871a185a8acd11e9dec9ec41d65d9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        treeview.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\treeview.tcl
        • Size 8KB
        • SHA256 3cadaea517d5cbb1f2ae09f8f5caef7b7d0104e71c07be7263d9af158ce2699d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ttk.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\ttk.tcl
        • Size 4KB
        • SHA256 61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        utils.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\tk\ttk\utils.tcl
        • Size 8KB
        • SHA256 c7cc9a15cfa999cf3763772729cc59f629e7e060af67b7d783c50530b9b756e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xp_install_tool.exe.manifest

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24082\xp_install_tool.exe.manifest
        • Size 1KB
        • SHA256 31b49865829acadbd65627803bddd758c18498450a7352034f52f02f5877f294
        • MD5 SHA1 SHA512 TLSH

        memory/2408-981-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/2408-982-0x0000000000160000-0x00000000001C3000-memory.dmp

        memory/2540-983-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/2540-984-0x0000000000150000-0x00000000001B3000-memory.dmp