15750b483d12484ea7e67f3532e78ee60437922245ef071afbc2a04beca3ef89

Resubmissions

11/05/2026, 18:51

260511-xhl1dagy2x

11/05/2026, 18:34

260511-w7vs5sgx3w7

Analysis

user interaction
yes
max time kernel
28s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
System_Critical_Update.exe
Size 6.9MB
Sample260511-w7vs5sgx3w
SHA256 15750b483d12484ea7e67f3532e78ee60437922245ef071afbc2a04beca3ef89
MD5 abb3fe328881ecb6712db54339380170
SHA1 776a355352c3632fdd5f90b7f4bf90379ca1e8ff
SHA512 f1a69bb84e112f88e340caaf90ab7c2f334fe3b58e7bff1158c474f53b47e11a3da9170115731dbca0a48461caa047c148836b532f1a7f9f22d974e308df8281
SSDEEP 196608:pCCaXMCHGLLc54i1wN+ijXx5nDasqWQ2dTNUGqli+iITml6M:pCCaXMCHWUj6jx5WsqWxTwbToJ
TLSH
T14A76339463E045F9E5F7803E98A29015EA71B8570775C6DB939C12D21E332E1BE7CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 12 IoCs

pid	Process
4396	System_Critical_Update.exe
4396	System_Critical_Update.exe
4396	System_Critical_Update.exe
4396	System_Critical_Update.exe
4396	System_Critical_Update.exe
4396	System_Critical_Update.exe
5564	System_Critical_Update.exe
5564	System_Critical_Update.exe
5564	System_Critical_Update.exe
5564	System_Critical_Update.exe
5564	System_Critical_Update.exe
5564	System_Critical_Update.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityUpdate_Fake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System_Critical_Update.exe"	System_Critical_Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityUpdate_Fake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System_Critical_Update.exe"	System_Critical_Update.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4396	3448	System_Critical_Update.exe	79
PID 3576 wrote to memory of 5564	3576	System_Critical_Update.exe	82

C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe
"C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe
  "C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  PID:4396

C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe
C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe
  C:\Users\Admin\AppData\Local\Temp\System_Critical_Update.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_bz2.pyd
Size 83KB
SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
MD5 30f396f8411274f15ac85b14b7b3cd3d
SHA1 d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA512 7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
SSDEEP 1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
TLSH
T1CE839E92E3956AF5F41F81B956C10367E771B945075083EFF348C2592F03B426EAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_decimal.pyd
Size 251KB
SHA256 da8bb3d54bbba20d8fa6c2fd0a4389aec80ab6bd490b0abef5bd65097cbc0da4
MD5 7ae94f5a66986cbc1a2b3c65a8d617f3
SHA1 28abefb1df38514b9ffe562f82f8c77129ca3f7d
SHA512 fbb599270066c43b5d3a4e965fb2203b085686479af157cd0bb0d29ed73248b6f6371c5158799f6d58b1f1199b82c01abe418e609ea98c71c37bb40f3226d8c5
SSDEEP 6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
TLSH
T11E445B16A2490CA4DE77807498979F47E7B278964360D3CF43B48AA77F573A323AD348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_hashlib.pyd
Size 64KB
SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
MD5 a25bc2b21b555293554d7f611eaa75ea
SHA1 a0dfd4fcfae5b94d4471357f60569b0c18b30c17
SHA512 b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5
SSDEEP 1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
TLSH
T18F537E09A69544E8C96781B8C8A35F57FAF2F1511710A7DF0368C28D2F237C3A6BB752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_lzma.pyd
Size 156KB
SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
MD5 9e94fac072a14ca9ed3f20292169e5b2
SHA1 1eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA512 b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
SSDEEP 3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
TLSH
T1DCF32992A394F0D5F6728C78D6624F17E7F67849032092DA02CCD36D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_socket.pyd
Size 81KB
SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
MD5 69801d1a0809c52db984602ca2653541
SHA1 0f6e77086f049a7c12880829de051dcbe3d66764
SHA512 5fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb
SSDEEP 1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
TLSH
T1E7835A12A69050F9DB73C0B6C6635F23FBB4B48013D5939F1166C66A1F33782BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\base_library.zip
Size 1.3MB
SHA256 26f8a330065a1077c929637f56cdf864066110b1790313c781ef5291a547dcd6
MD5 5ff6a5229e65be40559b90ffb09adc7f
SHA1 18525448efc3bd9363edcc870a185dba302e48d9
SHA512 26d2caf9e1aa9c25e8ef74781f653426e813f0d124c4574b7137e5494f2864d4b22a7ab15ff541021ddedd3f669330625122d68f323a15dc9575eb3d370deff9
SSDEEP 12288:O1dc8clJGUqYI/R+Lmn9RHtSYYTq+zYgEkA1qJuj+2/Hm/yquKYHcPndmmxaQv:A9clJGUywa9R0Yo2/HmXQcPndmm4Qv
TLSH
T14C55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\python312.dll
Size 6.6MB
SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
MD5 166cc2f997cba5fc011820e6b46e8ea7
SHA1 d6179213afea084f02566ea190202c752286ca1f
SHA512 49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
SSDEEP 49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
TLSH
T170667D697268C0A9C96BA0B0CC13C28AE7B27C517F50530B70EBB75E2F737A2535A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\select.pyd
Size 30KB
SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
MD5 7c14c7bc02e47d5c8158383cb7e14124
SHA1 5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA512 af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
SSDEEP 384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
TLSH
T1AFD29E576BB46845DD23C87268A28F26EE35B756871082CF3368C15D1F227C27B7B3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\unicodedata.pyd
Size 1.1MB
SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
MD5 a8ed52a66731e78b89d3c6c6889c485d
SHA1 781e5275695ace4a5c3ad4f2874b5e375b521638
SHA512 1c131911f120a4287ebf596c52de047309e3be6d99bc18555bd309a27e057cc895a018376aa134df1dc13569f47c97c1a6e8872acedfa06930bbf2b175af9017
SSDEEP 12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
TLSH
T18B354AC5BB828E66E87B31B944D1212F1361C273476B533BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads