0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe
Size 62.6MB
Sample260522-fa1ecsev6r
SHA256 0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4
MD5 67c37850e3e6a5863d305206fc854326
SHA1 9c4301f8965250b5f3aedaef58aecd7d190d3ab4
SHA512 3800013bf3e32f995e462ad4241e7658b900b70b8357568b767a1cab0742c3effb328f81976ecae11ead568d870b26cbe8a26849e9a79f24f297e88624b4f93b
SSDEEP 1572864:Z3DswoerEAnqqF1RSH2azhe31EKpuNe9akxMOXDPM5M23GG:Z3oCdnzFrSHPd217T0M23GG
TLSH
T194E73397086B364FEAFDEABDE62210EB344E365686A56F1FE340029C45325D0523DFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3484	pythonw.exe

Loads dropped DLL 14 IoCs

pid	Process
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe
3484	pythonw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3484	4724	0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe	79

C:\Users\Admin\AppData\Local\Temp\0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe
"C:\Users\Admin\AppData\Local\Temp\0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\pythonw.exe
  "C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\pythonw.exe" -x "C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Docs\FAITHED.TXT"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FAITHED.TXT

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Docs\FAITHED.TXT
Size 5KB
SHA256 a3d419f43192d30979260c2428e98ee0d23f66c65859ee9ac5a74e27eca34369
MD5 6a813e2971792cfbcfb66ba1721c1c21
SHA1 3c5d48a896c531416ebbc1469a1443ca7a3a15d8
SHA512 ea8946e6149534f96b7734fec38b10f78675b2c2cfd4713fc55bf56d72f06e6c6cb46d3964479a115caa94d3352331763efbc6473c7f2980af5bae4506f3aa23
SSDEEP 96:FJwDZ3mKt0IaeNbpYQxpkuBvKBrL0cMGDvYr4GFbXjDOrdgbMCmsyxSJl8AsPKGP:0VWY0EpnnipRjA44TOrdcm65GMzwX
TLSH
T1E1B1B630A0C5FDE21DEF47868421251ABC386D77AF202375DDCC068AB2D9144EB35AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\VCRUNTIME140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\_bz2.pyd
Size 81KB
SHA256 daee014b07418bffbbce7f9c802bf5cec03637bdc92140109af5cbaae276b435
MD5 f4313c51ca17764e3a40f389ea0f9a25
SHA1 4b3a870e6eee7ff90d5a9ec1e8d31397998ce176
SHA512 8eac0e33ed5aee5fc39cfeab523f60de1e19fe93b892e1e5a812cacede6ad04de00b36db284414ef930452ddd0e8f38afefd8b14e411e7b6ec8505545e40d565
SSDEEP 1536:UhKo7p9om0AJfDf1e+XkX38KfPUpIjLVzyvcvR9yfIbHIn9v:wp9D1DfPQsKnUpIjLV7TC
TLSH
T19C838EC1F9C64BDEE7277B7043C6F12AA13CD2258B60D8D7E696AC242B883B75531216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\_hashlib.pyd
Size 53KB
SHA256 9ef3c51a24b080ff36e38af63a7826dd530c2347daaba666c46775a361e1126a
MD5 5bb04cca0623507ed104ada0b066f57f
SHA1 eaa4342a0be8878579c6327d8fbba038fbf29052
SHA512 930313ec6974101aa217559c121b76c1f2e5787c75032f0627bca065c1115f98a504d90bf7b3f639637e36d45b75e7f8a5303b4374b2d488a61c033cf08fce71
SSDEEP 1536:Qg2SVk8r55akpxjzd/IOhIjvITOyvcvR9CfIkmy3:iSW8r55//IOhIjvIKK3
TLSH
T131335B45A4440067EBF701B472E49F6EA938E65103E835E3FA9B88D11B223E3E776357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\_lzma.pyd
Size 144KB
SHA256 85085c0b75e4a2bf921803eb9f443815cfcb49e5248fa3aa15fb9aefa2a34d14
MD5 96896097c079e8234990926d6d9a4cb4
SHA1 474b772d95ba1d0fb60f46a2f9cbdda54ca35d19
SHA512 9316908a85b14c418fb37c934c79ccced0df4d6c59f0d5bbecf08ee6c659e6239ac4cc052b5a37b0076b393094b7df24f86ca6b8180dbd88d16e1dc56707c4fd
SSDEEP 3072:8G18x04NoAZg0CTGx2inhjOjrTHuAdC1RHc93XHf09mNo5bVzpIj01jTE:804DcIn12djsYO5ZzDE
TLSH
T18BE349A2A506F1E2F2A50C78D2B99F7789F91548036441D7A0DC1B9C827F7F3A63A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\_socket.pyd
Size 74KB
SHA256 632744ade6eed91d0f86ea218ab8a72fd2aaa38d464195def674aaa5285ce97b
MD5 0aeea690a357528628e2474744c1a978
SHA1 2e067f519168c8830facd78c0720ad5f5ec2ec7a
SHA512 b1d808d17c60a962e1343d9dfc6a5beec42a0c8eafce0ec982f4c7f52d731c7b634cbac64764435bd674646dd4a798e4fd80020e2e7f630d3fd86b44ef9da543
SSDEEP 1536:usEcSTHqHcUskA61ycMBQlCp+Nenzt4o3vOtRyVIjywJF65yvcvR9FJfIbHMn9h:u7cS+8A1ycMBQlCp8enzOo32gVIjywJm
TLSH
T125734900E5215177F3E10C7075A19FD37E38A7A123A498D36F9B9C9945366E3FA39382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\_ssl.pyd
Size 158KB
SHA256 73191999e5cfae4997783f42e463796211b318f6e1be33a1f32fb8e056b63cd0
MD5 0448e896cd83a9752ff528f5c9d5823b
SHA1 cc1cd08c249aeb52eca0b0c4565fe06d4346a2b2
SHA512 9a5dfa019c3e8b49000c8f7cbe26ea0b5b7641fa55fb917eff6fbde6ebd9268668678d47b017dd34142c2654c6fec07e0a7a16d5cf59917bec811fc32df2770a
SSDEEP 3072:Z5kcxH1FAoujja67m96vPsov25hA9BXpIjL7sOsdiNj:Z5k2H1t8896vPLu/A3Xski9
TLSH
T122F37D05B51649E3F4DD94F8A36043A3AFA89111F3DE51E399E36CD10A387D26E38B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\libcrypto-3.dll
Size 3.3MB
SHA256 64a65ca297a879839e436269d1f8a257b7411d667c0988a4fbcd56729543d632
MD5 d8f2f3239154652f8da2427bed77cd00
SHA1 10af07cfd716c55bb204a495f638d2ebc997bf4a
SHA512 0edd1100884705643a7a6202b9439196f09971c6dd386049837a9f08c346f90989bfc62db8af062239435c714518ecde2c7664334752ca84d69da4853d8b7df6
SSDEEP 49152:PjLIqjUqLpLHVCInn8mxXF5UQIgBbp3Zv8Szt4+DLS1CPwDvt3uFlDCBD52ebh:PfIGfLxIg6o4+S1CPwDvt3uFlDCB
TLSH
T1F4F59E06FBA36692E9CF827D12EB637F0E391714D72489D38E622499C8355D1763F3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\libssl-3.dll
Size 624KB
SHA256 8dd682b158496623237d0d2acdd24156b791d91cbf0705a013a52137a7b3ae22
MD5 a12f68a8210588c4ecea30b5c1a15731
SHA1 c0716e8646e13bbb8fa778eaa6b5995b3e1c9267
SHA512 32148921b781ee56ba1272c8fec086abdd829379f7ec33b90d419b47f39b2a51c17915fd87d20413b3cbe4528d5b90765ae5ed5a17243f71e183facc7d475f3a
SSDEEP 12288:dM3j7WBILcJg7JJp0aWTSDkGzUZ5n3jNsynd+Fe9Xb29F:dMXWBIPy75d+Fe9Xb29F
TLSH
T1CED48D92A7C25DD1E0C940BA19BB1BBE1A3E93006724C5D34F919DA98D61BC6277F3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\python3.DLL
Size 70KB
SHA256 3f8b47ac323aaa3ce5238855d40163e7088927ffd42e92be7728c30c1c7e1f4f
MD5 00a09e2982ad3a595f29b1da83052de7
SHA1 37dce1bc8e2e793572faba7b222e21507fd5c0b5
SHA512 af87812392771f8b8ee555649fc40bebd1a713902ab652e74db1c75d935fd82d7dd5110c1831f29bfae0cdadfe28ac57eb7f4cfd36d1065f7f7aa731f8c96262
SSDEEP 1536:xotssyKcunV8P5VIjy08yvcvR9mfIbHGn9y:6tssyKOVIjy0OTD
TLSH
T14C633BC25B5BF8A2D6F669FC78DDD9CD242B02CC53258D9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313._pth

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\python313._pth
Size 80B
SHA256 35ddf94682ff9aa713a8d63557242ad00f3f28fdd39337f02c3bda4c0f791577
MD5 c23ad35e55e5b1a71ee2e9dd97723749
SHA1 3c5332fcf5e31d3c84fcba3eb722d4c36a1802cf
SHA512 9fd07332911783ff9d534d952eb8cfece7cbeb1934a34da2ab5274d671c38bdbc75e491b3bcac332dd882310c243f389ac6dc7c0eb80e9c0131dff2244e3ad73
TLSH
T140A0220208A30080002020283FC002F88F32330CAB003A0E8BC02E380B00E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\python313.dll
Size 5.2MB
SHA256 6737b73c3e5b6803747569388db667d308a4552d2983b65f7802986c75a782ff
MD5 94f0e63b4c79c7f4d46d03af218c7195
SHA1 d2610bc3b2f109394180cc001e9c9a25fd9353a8
SHA512 3397fc4fb32417223c792cd410912dd9f9e3fdf9f003827538e124362fae6a708b58f2960da1ef7f54cde291ec13e5589a6cf7cdf75a0e26876117a72793ceb7
SSDEEP 98304:HC6tEIABIXGfKqkMITl7ogwzF9+RvFIeHzMX/ZVMYo+i:HCXIXURhXHG
TLSH
T17D465C52740BC2E9FDB81879A2AA99F37D391D04BB6650C355523D2C4EB02F2E37E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.zip

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\python313.zip
Size 3.6MB
SHA256 7785897b464923335ba2b535364f77afb03e2c9b396f474039eb504f0d2366da
MD5 333925bb367618f01f40d3f2512fb1ea
SHA1 0e8f4822f02ceb6cdf998e61d3575db31b198c28
SHA512 fa13535c7b89541b9af57a2cbcf31525d9cf991260b7d0419ca2502f493c0ba80c7c3fe7f34c1df7849c2692954771f16878ffb648bacac8134955c85e4f9b03
SSDEEP 98304:LjZRhCPJiePNxaIE9jlY1pwvwlKeRI9WXx4JOMX:PhCPJhGlgeeS+4V
TLSH
T16906331384BEB947D657F335272CDA0BE51DD7B4B281D24FCDCDC2A1AC822A54B1E81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\pythonw.exe
Size 100KB
SHA256 93ad981c17a38861bf2b1c6b11682f1c16699acff774daa05671e3ad2cc3d742
MD5 f282a8d62a74c719397d2dbf86de3eab
SHA1 5ebe19efb83c1b1d89ed55a02f8fc427869d6c30
SHA512 54b85e1b115e81389cf476370756f973795e3313f93cebf3e79f3eb1ab1bc30b5a833ecf9fb6e444093b941ce1bd6c33e1e0caae631beda4f026c39d0fed83a0
SSDEEP 1536:Do2kDhIxHHWMpdPa5wiE21M8kJIGFvb1Cwf/G0smHyvcvR92fIkco:sSwMpdCq/IM8uIGf9/G0sAe
TLSH
T1EEA30841E62DBDCEE548D5314A75E0F25E24ED323580A51EB7F37F462835293FA0A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\select.pyd
Size 29KB
SHA256 ef1816d33f543054534597367ccd34a4211d3e5ce25bd129bbe8e82b90421411
MD5 e51b81f415c24302ba84c19c84bbfc1b
SHA1 186934fe8c54b39e4fdc06fc2933eaaead57383c
SHA512 e94c5572e4a9e5354f597d0b885974097850bb69e7f3f7015b8647f072630804f6f2a567297d8ab8455daf643e4a1a51de84a920e69fb152a3b5cad623773aa9
SSDEEP 768:fmTkkS/mnfF/oPy4VIj9GcYyvcZRYT2Ip4w8mTxf1mlIJRlv:fmokhfW64VIj9GtyvcvR9wbfIkRR
TLSH
T1ABD27E8A9A1480B3EAD229B067F5C993B939B7A31DD44D9331EB81840E573C1FF37169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\ff0394ae-6f19-4c56-a3aa-942755bee6ad\Py\unicodedata.pyd
Size 686KB
SHA256 d483bfe9dfa08dfac14294e6b7cb6daf98e813b249cc2f75c4784c5fd877f281
MD5 660bcf2afcb49986ae8f4a02a121d80b
SHA1 851064ba279a85bf56dea1b36d34a18842942413
SHA512 89a7e3cb2c67f44005037049f6d7988f1bcefab018a98c9a8a982cf99726e0d4c6ca3803f0a2040e1cb406d4054e2580c483df7ef9c2d5d143af269f91e2b225
SSDEEP 12288:AvNdLI/X77mvfldCKEMihH32W3cnPSqrUNpP:AvNW7qNxEd3cnPqpP
TLSH
T1A9E4F5D9BBCF8D26E68B363948E3710F5171C3B35F1A8636B6182361D85B3B449D182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads