829f724cbbe33f4ee3657409761823f2c22f80adec2c970d2916457f1e7bd79d

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/05/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stager.exe
Size 5.3MB
Sample260523-kcsvhsey8m
SHA256 829f724cbbe33f4ee3657409761823f2c22f80adec2c970d2916457f1e7bd79d
MD5 c74498484711155559a489470aec8303
SHA1 cbbe35eb6322da91aa97f1e8ab598daa4233a138
SHA512 fd9839d2f8ec9b22f269382648d278169ea579892323bcb80c02dae391ea14caa7610f382a13fd7956c301b6347d84ee2495cbc593155575513880346613104c
SSDEEP 98304:27Rl3eFXwczb71QGQCPDbZfx8ayCb7BJ5mjwNwwMeZYobSr+cmureFMG:EluXtdQmRJ8aycBIGpEoYXHG
TLSH
T1454633A4A7E818F9F9A7D13C8D738069D67279164370D2C703DAC65A1EBB3E02C76721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 11 IoCs

flow	pid	Process
5	648	stager.exe
33	3476	stager.exe
35	3476	stager.exe
36	3476	stager.exe
38	3476	stager.exe
39	3476	stager.exe
31	3476	stager.exe
32	3476	stager.exe
34	3476	stager.exe
37	3476	stager.exe
43	3476	stager.exe

Loads dropped DLL 16 IoCs

pid	Process
648	stager.exe
648	stager.exe
648	stager.exe
648	stager.exe
648	stager.exe
648	stager.exe
648	stager.exe
648	stager.exe
3476	stager.exe
3476	stager.exe
3476	stager.exe
3476	stager.exe
3476	stager.exe
3476	stager.exe
3476	stager.exe
3476	stager.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1660	icacls.exe
2028	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeBroker.exe"	stager.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2628	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2176	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 648	644	stager.exe	83
PID 648 wrote to memory of 420	648	stager.exe	84
PID 420 wrote to memory of 1660	420	cmd.exe	86
PID 648 wrote to memory of 1276	648	stager.exe	87
PID 1276 wrote to memory of 2028	1276	cmd.exe	89
PID 648 wrote to memory of 796	648	stager.exe	90
PID 796 wrote to memory of 2176	796	cmd.exe	92
PID 3036 wrote to memory of 3476	3036	stager.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\stager.exe
"C:\Users\Admin\AppData\Local\Temp\stager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\stager.exe
  "C:\Users\Admin\AppData\Local\Temp\stager.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /deny "Everyone:(DE,DC)" /inheritance:e"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /deny "Everyone:(DE,DC)" /inheritance:e
      4⤵
      Modifies file permissions
      PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /deny "SYSTEM:(DE)" /inheritance:e"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /deny "SYSTEM:(DE)" /inheritance:e
      4⤵
      Modifies file permissions
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsHealthService" /tr "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /sc onlogon /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsHealthService" /tr "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4528

C:\Users\Admin\AppData\Local\Temp\stager.exe
"C:\Users\Admin\AppData\Local\Temp\stager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\stager.exe
  "C:\Users\Admin\AppData\Local\Temp\stager.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  PID:3476

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
Size 12KB
SHA256 ec291800aeb343c275418aa68da6a5c1b067f48520861a5743e3050aa21341e2
MD5 fa8d1f016204839cca88e7c22573bc22
SHA1 dfd9ede6c0931eea56adf9ea75c073e8a0e09f78
SHA512 6d45f0b341cac418b7a4562ab41b05b66a2f9b973ba358329af90a8c43c39df9467f8a6daa7cb01f98b00167fe4c85fc131c4748a141f29cafdc18a8b8d343e1
SSDEEP 384:9COQOv/+J3rJUOVZ17MTZw5thvDHloYKo6u:oOf+RJBVTyZ6fy5o6u
TLSH
T11042A709A758605EF543723F864BD01BF640F023EB64E9E7772683552F637E2A93068C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\_bz2.pyd
Size 81KB
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
SSDEEP 1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
TLSH
T10B839D93F76095B5F41BA2759AA14393E331FE49039093EFB244831B2F13B913C6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\_ctypes.pyd
Size 119KB
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3
SSDEEP 3072:YjjHoXs01LUZJNUoNZf4adhfrI70s3nRI7QPY2xB:Y3HUJ6f5dhfrIHX1
TLSH
T178C36C5B2354109AEA678078C5B35F47DB71F859172083CF02A4CA9E2F637A36E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\_decimal.pyd
Size 242KB
SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
MD5 6339fa92584252c3b24e4cce9d73ef50
SHA1 dccda9b641125b16e56c5b1530f3d04e302325cd
SHA512 428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84
SSDEEP 6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
TLSH
T150345C16A3490CA4DE778074989B9B57FBB278854360D3CF43A4CAA63F576A323BD344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\_hashlib.pyd
Size 60KB
SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
MD5 d856a545a960bf2dca1e2d9be32e5369
SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
SSDEEP 1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
TLSH
T136536D05A69440B9D8674278CAD71F5BEAB1F0405351ABEF0358C1CE2F237C3EAB6796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\_lzma.pyd
Size 153KB
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
SSDEEP 3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
TLSH
T1F8F33992B394F4E6F6228C78D6664F13D7F678490320829A12CCC37D2B1FB755A2A717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\_socket.pyd
Size 75KB
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
SSDEEP 1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
TLSH
T1B0735B12A69050B9D2738175C6635F23FB70F480139593CF1264DAAE2F23792EF7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\base_library.zip
Size 859KB
SHA256 5454f34603fc781a8abc0fbedd1500b04642ae9d7ae91292019b41f80afcb22a
MD5 161c3c347dee2623dc71a3837265431b
SHA1 c74acb90e866fe2b73265adb9e594b45aa4e17fb
SHA512 b413141c03fe020c1a313ce5cd145a32210823140c97e138e38f731893e3d61adb31c10b934265b3cab667b46e59a9625f465560e4f377572b54c7d67d8eca67
SSDEEP 12288:CdIA4a2YIfVwxVQK6uBScyo+iS6fpEn0gYJuKxzMNkzI:BLa2XVwxDS7o+cfpE0gYJPMNcI
TLSH
T1E2153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\python310.dll
Size 4.3MB
SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
MD5 deaf0c0cc3369363b800d2e8e756a402
SHA1 3085778735dd8badad4e39df688139f4eed5f954
SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
SSDEEP 49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
TLSH
T1DC267B22A26401A4D9B79477C5238647CBF1FC552F20E34B41A4BAD92F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\select.pyd
Size 28KB
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
SSDEEP 768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
TLSH
T111D2AF8B9B9058C9E863C57258E64F02FA34B661875082DF3319C26D2F237C277B6769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6442\unicodedata.pyd
Size 1.1MB
SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
MD5 4c8af8a30813e9380f5f54309325d6b8
SHA1 169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA512 ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
SSDEEP 12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
TLSH
T18A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stager_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
Size 274B
SHA256 32179ee07d055ef177e54c17c046014e723a84565e5ac90deea2461a56ab5892
MD5 6283f13bc01bd1369438b9afb2c20a7a
SHA1 baae4d7e6f31e787aa097fed9927b0a2a9aa9cfc
SHA512 380d3ed2a2483f98f18b1d4fba785409e8a6bb4f918a2c28195c051dbbf27b595e03d6e471521954626926f8d277b33b82bf8701d0533857e24485a8f7cda259
TLSH
T176D0629473B8ADD7C6548E4173734F74AE533655B40C34D17736D32E7500A636D489A8
MD5 SHA1 SHA512 TLSH

Submit Download

stager_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
Size 1KB
SHA256 e52c89a1495f552c43538c125dbb221a9e5d730538b34fcb1b3685933ddf60d4
MD5 947a0536b3fd2f542d6419c080554135
SHA1 b57061f3c3fc782370675f3057a44a3b3889d69e
SHA512 eadbae81a3cd579d5b648e244e063575458d025e725293804406d6a3c25a633d558dcaf6a6bc7363b746742fabf14111d1948af7063ead0057cbcb18018786e8
TLSH
T1D9219F1462FAB5C7CA954906B3734FFCAE273606B50C34D57332E129B0409B3AEC9AA4
MD5 SHA1 SHA512 TLSH

Submit Download

stager_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
Size 1KB
SHA256 ee4cdd0d94dd8f973ff188095c18a79ab6274ac4dc2685e5f15e68d29a60ea54
MD5 d694eb9f26a0de65f7a9f76c317c8fa9
SHA1 e7a2a4a27f71c4f2cf5e17dcb194981873a453d5
SHA512 124e1e8d1ccb2465ec5046bd6adb80193e0c6c01488e73039312add819dafc1026ebb5fa1eb2ccf6a9495cffa354ae75adcb04b5a8da755a34ae1d5d74b47fb2
TLSH
T11E31C01462FBB5978AA14416B3735FFCAE273205BA4C35C47332E11974409B3EECABA0
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads