Overview

overview

8

Static

static

3

Cwelium.exe

windows10-2004-x64

7

Cwelium.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    119s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 15:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Cwelium.exe
  • Size 13.6MB
  • Sample260623-s3fa4sd14x
  • SHA256 44647152284cb7caed6cfe797875f31f1c4cb1f170d4ee58e8e1510def68697a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 23 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
    "C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5408
    • C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
      C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:2076
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:1712
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:5536
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              3⤵
                PID:3132
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                3⤵
                  PID:1952
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4080
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2560
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3424
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2704

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 595B
                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
                  • Size 83KB
                  • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
                  • Size 122KB
                  • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
                  • Size 81KB
                  • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
                  • Size 174KB
                  • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _uuid.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_uuid.pyd
                  • Size 25KB
                  • SHA256 8ae23bfa84ce64c3240c61bedb06172bfd76be2ad30788d4499cb24047fce09f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _wmi.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_wmi.pyd
                  • Size 36KB
                  • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cacert.pem
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
                  • Size 292KB
                  • SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
                  • Size 5.0MB
                  • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
                  • Size 774KB
                  • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
                  • Size 30KB
                  • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tls-client-64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll
                  • Size 17.8MB
                  • SHA256 b177778656455f6b8482154238d323a3de4d74f2a8b7a62bd973251a259edb87
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
                  • Size 1.1MB
                  • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Cwelium.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\Cwelium.dll
                  • Size 15.2MB
                  • SHA256 6154e8358ee068558b9e9b06737f696651d796697cda15debc4164eebc6d3302
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\_hashlib.pyd
                  • Size 64KB
                  • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\_lzma.pyd
                  • Size 156KB
                  • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\_queue.pyd
                  • Size 31KB
                  • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  md.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\charset_normalizer\md.pyd
                  • Size 10KB
                  • SHA256 ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  md__mypyc.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\charset_normalizer\md__mypyc.pyd
                  • Size 120KB
                  • SHA256 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python312.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\python312.dll
                  • Size 6.6MB
                  • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcruntime140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\vcruntime140.dll
                  • Size 116KB
                  • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  backend_c.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_5408_134267027448953479\zstandard\backend_c.pyd
                  • Size 508KB
                  • SHA256 641e0b0fa75764812fff544c174f7c4838b57f6272eaae246eb7c483a0a35afc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2560-271-0x000000000F550000-0x000000000F5CC000-memory.dmp
                  Download

                  memory/3424-126-0x0000026413E90000-0x0000026413F90000-memory.dmp
                  Download

                  memory/3424-114-0x00000264001E0000-0x00000264002E0000-memory.dmp
                  Download

                  memory/3424-159-0x00000264142A0000-0x00000264142C0000-memory.dmp
                  Download

                  memory/3424-146-0x0000026403C90000-0x0000026403CB0000-memory.dmp
                  Download

                  memory/3424-125-0x0000026403A30000-0x0000026403A50000-memory.dmp
                  Download

                  memory/5384-84-0x00007FFA83EE0000-0x00007FFA84E42000-memory.dmp
                  Download

                  memory/5384-77-0x00007FFA82190000-0x00007FFA8331F000-memory.dmp
                  Download

                  memory/5384-76-0x00007FFA83EE0000-0x00007FFA84E42000-memory.dmp
                  Download

                  memory/5384-75-0x00007FF715370000-0x00007FF716134000-memory.dmp
                  Download

                  memory/5384-312-0x00007FFA83EE0000-0x00007FFA84E42000-memory.dmp
                  Download

                  memory/5408-74-0x00007FF715370000-0x00007FF716134000-memory.dmp
                  Download