Overview

overview

7

Static

static

3

c13c6923bd...d0.exe

windows10-2004-x64

7

c13c6923bd...d0.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/05/2026, 02:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.exe
  • Size 33.9MB
  • Sample260529-c2fbqabs2j
  • SHA256 c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.exe
    "C:\Users\Admin\AppData\Local\Temp\c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.exe
      "C:\Users\Admin\AppData\Local\Temp\c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\VCRUNTIME140.dll
        • Size 88KB
        • SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp311-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_brotli.cp311-win32.pyd
        • Size 731KB
        • SHA256 cf36109a0a53c36c9a6edc98006ffeaef129c6308068f70d4c6b057a99981979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_bz2.pyd
        • Size 79KB
        • SHA256 3346a214d1abbf7570d12082b1853f95f279c16a7802a64d64cf6a859b79afb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_decimal.pyd
        • Size 195KB
        • SHA256 c6ea79aa895c978b10c6961501d09e5fea2385d6a2319faf68b9a4dd2b2f60a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_hashlib.pyd
        • Size 48KB
        • SHA256 06e05614c8ca3f54d08f88134a175e4bd760bbfafb97685d0cd1ff7660560c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_lzma.pyd
        • Size 145KB
        • SHA256 6bec1d6bb71da6f743e1db6140c63487bd590572f28eb3542184fddbb76d61c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_queue.pyd
        • Size 27KB
        • SHA256 c4400868c02ce5aba5b48ced18b6315ae4fda14c2c8a23a0eb3a05b24f690308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_socket.pyd
        • Size 67KB
        • SHA256 b3ea7c7e3fe0acdec27d0e8e046d102a909973b3a4d269a0fec3b94f056e696d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\_ssl.pyd
        • Size 151KB
        • SHA256 2750d8d79179e34de65e044d396849889824a5c10f5c1195a4a8916cc3864da6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\base_library.zip
        • Size 1.4MB
        • SHA256 ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\certifi\cacert.pem
        • Size 275KB
        • SHA256 794d039ffdf277c047e26f2c7d58f81a5865d8a0eb7024a0fac1164fea4d27cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp311-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\charset_normalizer\md.cp311-win32.pyd
        • Size 8KB
        • SHA256 4bf3600df9b4ff165ad3be28a89d2036f9d8b3ab8fd856fe0cf8826694d38e97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp311-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\charset_normalizer\md__mypyc.cp311-win32.pyd
        • Size 93KB
        • SHA256 aa7d447208fcefdb6fbe0da78d6c931ddccbd7b501aea88fef536b256c3becaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\libcrypto-3.dll
        • Size 3.3MB
        • SHA256 bdbf2ff122354b0e219df81293de186cecfd966fce64e3831b798ffd7c3fc815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\libssl-3.dll
        • Size 622KB
        • SHA256 09476cafb962f5aeb646663a852745b65d53c4af4f3f8c68077216fecc393434
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\python311.dll
        • Size 4.7MB
        • SHA256 22dfa280dffd308965c7990cb3f9c452d2437a145c9e36f82e84e8642fd45034
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\select.pyd
        • Size 26KB
        • SHA256 6e3e63b55e261000dbb657bb16af37e37405f2919331ce4c9aecd87c2e9d4b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27882\unicodedata.pyd
        • Size 1.1MB
        • SHA256 0bce170be38e5b8f711b2a1fbcc6b61b3715275a6f0356ac698ce696b7c848c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download