Analysis

  • max time kernel
    50s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 17:53

General

  • Target
    Lilystuff (1).exe
  • Size 32.5MB
  • Sample260602-wgnbdaby8v
  • SHA256 9408bab0150340e74a2dfb61206dd485ac33631a89e07690e34340763741f0f7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lilystuff (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Lilystuff (1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Users\Admin\AppData\Local\Temp\Lilystuff (1).exe
      "C:\Users\Admin\AppData\Local\Temp\Lilystuff (1).exe"
      2⤵
      • Loads dropped DLL
      • Sets desktop wallpaper using registry
      PID:3744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp314-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\PIL\_imaging.cp314-win_amd64.pyd
        • Size 2.5MB
        • SHA256 b4e06283c347910b5973bd5732159ea9eb26eda48e3eed183be2e3382db26597
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _imagingmath.cp314-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\PIL\_imagingmath.cp314-win_amd64.pyd
        • Size 25KB
        • SHA256 a1c024d3e0e75802e3249a1a33335809b6cf032749ed2c4507d622d6610e36f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_bz2.pyd
        • Size 86KB
        • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_ctypes.pyd
        • Size 139KB
        • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _decimal.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_decimal.pyd
        • Size 283KB
        • SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _elementtree.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_elementtree.pyd
        • Size 135KB
        • SHA256 1f8259cc74aed52e4cd2de6cb1b54bec8b1725a84760c1c5b30ded49f652824a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _hashlib.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_hashlib.pyd
        • Size 67KB
        • SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_lzma.pyd
        • Size 157KB
        • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_socket.pyd
        • Size 85KB
        • SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ssl.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_ssl.pyd
        • Size 180KB
        • SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _zstd.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_zstd.pyd
        • Size 491KB
        • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\base_library.zip
        • Size 1.3MB
        • SHA256 83ac5a62b246b347b09a0050f88ec85c81b36a4f80fa912a9abd7af67bf8ca25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\libssl-3.dll
        • Size 776KB
        • SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\pyexpat.pyd
        • Size 214KB
        • SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\python314.dll
        • Size 6.5MB
        • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\select.pyd
        • Size 32KB
        • SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\unicodedata.pyd
        • Size 740KB
        • SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        164.jpg

        • Path C:\Users\Admin\Desktop\164.jpg
        • Size 61KB
        • SHA256 d244a26dcf9d93d695f2ca13c022aaf04b4e33961d552ffc2a206b31e6a3be04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        165.jpg

        • Path C:\Users\Admin\Desktop\165.jpg
        • Size 62KB
        • SHA256 fc494bae41d8b34cb334ec40fb0f62711233c0cbe7fbe3740296355e271109f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        166.jpg

        • Path C:\Users\Admin\Desktop\166.jpg
        • Size 53KB
        • SHA256 1d3a1e16bbc350857a64c835afebc6c3d4d3a7db28119b31df60fe9e17f32da3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        167.jpg

        • Path C:\Users\Admin\Desktop\167.jpg
        • Size 70KB
        • SHA256 a3f12f1fd66fa46817236af38d1d7d801fc0e2460c48c84bec8aed7791776eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        168.jpg

        • Path C:\Users\Admin\Desktop\168.jpg
        • Size 78KB
        • SHA256 f1680cbea6a86c12f3736616fb38763bad6c78031e7eaf2614042ec553097ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        169.jpg

        • Path C:\Users\Admin\Desktop\169.jpg
        • Size 70KB
        • SHA256 f512e158eb726fb2dc8c74580c851e243d82c5a716018618e7444a3c17c008f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        170.jpg

        • Path C:\Users\Admin\Desktop\170.jpg
        • Size 90KB
        • SHA256 762dc3c3814475ebe61dded8a0b58c21ee21ffc2c0eb058270da4926bcb5a42f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        171.jpg

        • Path C:\Users\Admin\Desktop\171.jpg
        • Size 40KB
        • SHA256 f91e83861d3e7166cba16cab48139d6f5a4556fddd6f110c3b5af0ef48dd30e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        172.jpg

        • Path C:\Users\Admin\Desktop\172.jpg
        • Size 56KB
        • SHA256 12b957c513b41a057676febcc36b7c51a631773ac32c61de25433cd727c35248
        • MD5 SHA1 SHA512 SSDEEP TLSH

        173.jpg

        • Path C:\Users\Admin\Desktop\173.jpg
        • Size 83KB
        • SHA256 6191dfe42f5cf096bff557b962419f725df0a05a0caa3e306d3211e7acb18e46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        174.jpg

        • Path C:\Users\Admin\Desktop\174.jpg
        • Size 72KB
        • SHA256 df5ba9283b26a82b6c90cbdc4ca709ad54e0353b3ad82bee56842bab2fff01da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        175.jpg

        • Path C:\Users\Admin\Desktop\175.jpg
        • Size 153KB
        • SHA256 ac1951ba8775ae6ba87ffaa7630057d0cc73cd58bd26afc826fb387c6f5231bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        176.jpg

        • Path C:\Users\Admin\Desktop\176.jpg
        • Size 88KB
        • SHA256 faf245e33ae0bd56c227ff84c6074af9e01c662c3b3f22fa83b757c1278b9fd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        177.jpg

        • Path C:\Users\Admin\Desktop\177.jpg
        • Size 581KB
        • SHA256 ea39bee7366a4361722dc3a5ed6d900b7be36df1a498b40cdca275db4b24478c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        178.jpg

        • Path C:\Users\Admin\Desktop\178.jpg
        • Size 99KB
        • SHA256 f6e3d10de9a190f3bd0a170b2dbfe599deee26edda7e3c1462ec107a35e9e9af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        179.jpg

        • Path C:\Users\Admin\Desktop\179.jpg
        • Size 500KB
        • SHA256 852b0662fc0166e72442a1f909f32827cdfb05868ae84bec2c53513e894bec8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        180.jpg

        • Path C:\Users\Admin\Desktop\180.jpg
        • Size 62KB
        • SHA256 cd6a90fa62891f405921288ae1728d0c3b337de20eac99a033282dc94afb8614
        • MD5 SHA1 SHA512 SSDEEP TLSH

        181.jpg

        • Path C:\Users\Admin\Desktop\181.jpg
        • Size 197KB
        • SHA256 26dcb3d82fbce5021fc097118277832b30e66198cd7a36f2dfd878a10b8fa528
        • MD5 SHA1 SHA512 SSDEEP TLSH

        182.jpg

        • Path C:\Users\Admin\Desktop\182.jpg
        • Size 33KB
        • SHA256 13a37f31d1ef4a306e6ed6638f05b3e306bb886c2512db6d9aca84c683887dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        183.jpg

        • Path C:\Users\Admin\Desktop\183.jpg
        • Size 47KB
        • SHA256 7174328b661c5a8c07da00d7b3f789d34a580f01185cb5820f86d625f920ba59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        184.jpg

        • Path C:\Users\Admin\Desktop\184.jpg
        • Size 238KB
        • SHA256 38027e0107929af66ef5dec81a0436076fab3edbb508c170cd2645dfd356aa3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        185.jpg

        • Path C:\Users\Admin\Desktop\185.jpg
        • Size 187KB
        • SHA256 b3436a2e777ca99cf7a4dcd5a5af2f87d26002732fbd683ebd4d32f59bbaeb43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        186.jpg

        • Path C:\Users\Admin\Desktop\186.jpg
        • Size 320KB
        • SHA256 ab7ad67cf0933670ceaaf00f115ad08801202f2df1f34e2e427ab1fa1ac80641
        • MD5 SHA1 SHA512 SSDEEP TLSH

        187.jpg

        • Path C:\Users\Admin\Desktop\187.jpg
        • Size 489KB
        • SHA256 5b73802dc9a1d2aece9b4dab9e8d102ce538932702f79c1a90931b7b69f6de48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        188.jpg

        • Path C:\Users\Admin\Desktop\188.jpg
        • Size 410KB
        • SHA256 ad712500d0a6cbefa4331e57c751f34eee68debabc69eb2692d243b2dc01bde7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        189.jpg

        • Path C:\Users\Admin\Desktop\189.jpg
        • Size 46KB
        • SHA256 59e27c6efc6aede57b8051e05cda56c012442b2df96c6161dda21ce5c75fe3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        190.jpg

        • Path C:\Users\Admin\Desktop\190.jpg
        • Size 519KB
        • SHA256 96d95e678fe890d37712dd440b7bbca10de9cbfb689bb36429de2d2fafbd0e55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        191.jpg

        • Path C:\Users\Admin\Desktop\191.jpg
        • Size 419KB
        • SHA256 8c5da8f6bf097163548cb579cd50906908cc6f27514e744dd22b0acc6f07f21c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.jpg

        • Path C:\Users\Admin\Desktop\192.jpg
        • Size 60KB
        • SHA256 12fba2ca6b56507b8542b50ba7ca1b46e4b4ca2838dd493fd4ac2bc95a29ddb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        193.jpg

        • Path C:\Users\Admin\Desktop\193.jpg
        • Size 103KB
        • SHA256 884b5c1610111e09f7ab6e8b011dbc74532aaec33147a5a4f7d954766c4cd590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        194.jpg

        • Path C:\Users\Admin\Desktop\194.jpg
        • Size 67KB
        • SHA256 83887d72adcdd8add0a96a47557adede25b1daa94b02c2abe7503b0981e8897f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        195.png

        • Path C:\Users\Admin\Desktop\195.png
        • Size 268KB
        • SHA256 86fdd4c50953719fe872b38ef46c4c27d70974cb536a857da214153e617133ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        196.jpg

        • Path C:\Users\Admin\Desktop\196.jpg
        • Size 112KB
        • SHA256 484b0ace9ea35931080aac7a5d34044116c99a8c50aff35c7c88ee120cebad09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        197.jpg

        • Path C:\Users\Admin\Desktop\197.jpg
        • Size 67KB
        • SHA256 cd0faf0f922c8e679e582da11b896d71a8a5126aca807677f3404093db893ec9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        198.jpg

        • Path C:\Users\Admin\Desktop\198.jpg
        • Size 98KB
        • SHA256 942a885aa33b3701c92c800eb5d59139402eefe3a4dae014f9ce94e69d76a8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        199.jpg

        • Path C:\Users\Admin\Desktop\199.jpg
        • Size 95KB
        • SHA256 cda6ca4415c15a5e804ede59f63d2d221b410f7746023d3e98d5bc4dac2934b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        200.jpg

        • Path C:\Users\Admin\Desktop\200.jpg
        • Size 206KB
        • SHA256 5f8955fedf5c3c76ac663e0458253f20a434efa2530c26f05e8e72c32273a2c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        201.jpg

        • Path C:\Users\Admin\Desktop\201.jpg
        • Size 49KB
        • SHA256 58d3d2afa5c7f9641c6580c4866235b7535405e06ca09c36e94b2f540a898b27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        202.jpg

        • Path C:\Users\Admin\Desktop\202.jpg
        • Size 76KB
        • SHA256 2db573db794de84e6b95e5ba46ae5c845f2b9983e65698368bb67fb380bfc161
        • MD5 SHA1 SHA512 SSDEEP TLSH

        203.jpg

        • Path C:\Users\Admin\Desktop\203.jpg
        • Size 54KB
        • SHA256 6a5df1c153fb36d729242dbdb9731b7f0581aea9fd164bd57a53bafb873ed1b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        204.jpg

        • Path C:\Users\Admin\Desktop\204.jpg
        • Size 345KB
        • SHA256 e87de471b8a330737c0eca880faebb1a7c777f445bcb35971792409d19c1951d
        • MD5 SHA1 SHA512 SSDEEP TLSH