Overview

overview

7

Static

static

3

client.exe

windows11-21h2-x64

7

Resubmissions

25/06/2026, 04:45

260625-fdnvqshs7w7

23/06/2026, 16:41

260623-t625qaev4x8

23/06/2026, 16:38

260623-t5wasaev2v7

Analysis

  • user interaction
    yes
  • max time kernel
    52s
  • max time network
    55s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/06/2026, 16:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    client.exe
  • Size 72.4MB
  • Sample260623-t5wasaev2v
  • SHA256 a1b8a08c644ab9c4dc30a79399517a70f6b073137006d17ec06bbab81d61fc35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 53 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\client.exe
    "C:\Users\Admin\AppData\Local\Temp\client.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5480
    • C:\Users\Admin\AppData\Local\Temp\client.exe
      "C:\Users\Admin\AppData\Local\Temp\client.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5844
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:6064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
        • Size 213KB
        • SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LIBBZ2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\LIBBZ2.dll
        • Size 81KB
        • SHA256 25a4aae35dd89709620106db311af5bca7c868182b961e106a895ae14d2fc98a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 0205071c36c17f1efbd70178c852cb7d49985c484202752b8704b7ac6b184e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\_bz2.pyd
        • Size 35KB
        • SHA256 12c6fda28fa6e2668197469896dd6f812365e3875e1e73e4f9bc497a9a1728fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\_ctypes.pyd
        • Size 138KB
        • SHA256 3061c3be3f1332b8a66b5aa9fc64a5a787a1bfcb9dd04c8fa47fd45ea841dc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\_lzma.pyd
        • Size 47KB
        • SHA256 fd6ceb04e4261fd42a3bcaf1023cb3972378cc0ad4e8104146047daf603440fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 6df76986aec08e89ea037bc5271caaa82c69bd7eefba4fc293f92de1b1213e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 c541697c3e9086c6483e88d9cc8fe8a2efc74f663da0b0662babc04d3f79000f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 fed0c40d172de4de52dc2230c5c92fd6bc8e8553619d5bb5240dcc4f025dc8cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 cdae6e7d24d4ca4b491d483135740cc60f2dfc74dd2e01779e655b9f8f85a337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-fibers-l1-1-0.dll
        • Size 21KB
        • SHA256 cbb6cb7ff25363b07647ea05d01f2881837d50b04bba4debe875a4aa3a307c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 02c96dde747ea574fecfb93d43dd9829236a1b22f0eb5513c0e0b27b7bdac934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-file-l1-2-0.dll
        • Size 21KB
        • SHA256 682968c7640a1d55485b7c10dfdaf520b1e1c73a8be267853e80be893be3fb49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-file-l2-1-0.dll
        • Size 21KB
        • SHA256 45a0eb1b83f448054536d3aa628393b7418477897e841c66384ecc7f4f18c2f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 9986a39b7f2e067ee7d1f2b3db0b940e2b75900152f099ff41cce8ddd47565e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 54b51444c8b6c9342fd20f5a5b0909a906acd0bdc9cf4d70134d5f8cffbe3209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 ff341ef2c2c389d44bbb1c919ff42ec360015985c0dae2ac760ac5acad0cb1d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 6cbc929f814d7e931e0f6f510da1696b059c53bf66934a68d218d3342ce4a289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 3ddbcd067d495845b7134f30bcea031ad558df4acb562b2f3190941913227158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 bfa2145c3d615540193a41c9f9605018062307e9fcf1665c390f0034178ecb4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 4fcb066de08f48a490e7d50417469ab3099b4a7fe318a8845e4ec9b3e3fd52be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 f3a31997c715dec8a6857d87be217c7acb893839156838ba20b5ef818ad5c9b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 470e9d04a1aa19c6b84b5b10cb055ff55caabe0f45d63090865c196b66c295f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 21KB
        • SHA256 4e57ceffbc2ef0e4dbfb92854756f97d2b34d9e29db16f46c476ed360b92b1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 0a3a017ca780353d56157682edda4cc3a19a236625fe0f2356faf635cd4f6ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 243c00a13c8fd6d764ebf22ec5a93492043949616561697b776fe9f62360665b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 be439f71ed591f8f65b8894e84569cf3cc3363d88536e49bdd998e49e069d0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 83e86bee356668319f4115846ed9a571cdb37cd8a0eb036fc2a960bdeafcb526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-synch-l1-2-0.dll
        • Size 21KB
        • SHA256 718bbb66ed24612c40f415ef11f07db287b1bdf0b130667689d1cdce3a1bee29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 8e28db596d46ca22f16d8825bebc9406cd01d5efe4233a2eaa6b450473741766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-timezone-l1-1-0.dll
        • Size 21KB
        • SHA256 b29f3f250eed6d05bc000a1020ca65215838c3733b78293dfca459031df575f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 4f79b6338f8438e63627b174d5b1bee2d2dcfc40a6119221317fe3f0d8b1e1a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 7320687be8b742cd70ac0e5f1b0a854502063f9b291147785aa7355a38de162d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-convert-l1-1-0.dll
        • Size 25KB
        • SHA256 3550d96592baf95f0be865503d98f47c8c8d4d36b01190589bb7bd08585c739d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-environment-l1-1-0.dll
        • Size 21KB
        • SHA256 167a2b52964458b16aaa166de281e52c35dfe920380c9c7783a06678b665b2ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 255c9a44ed1106c673821ed4ef165788d6bcc94b2924d0fa1d36af4fc2eb0b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 dd4be34d6de584a82f12803b1be98afd48bf2f82e87b8cb77141b41ea6393cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-locale-l1-1-0.dll
        • Size 21KB
        • SHA256 93fe93380fae70f12ebe85b92e5326321400861167ee0ac858a81d2f7fa37d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-math-l1-1-0.dll
        • Size 29KB
        • SHA256 6ea15153e8948e7fc9e0aee7cfc5cb7b9b8f872f94e6714bc510b9bc7291ad9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-private-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-private-l1-1-0.dll
        • Size 73KB
        • SHA256 558ce3eb8b6fe5752008385e225df7a74eae6e8fef74ff0b23ee4ee7e21f87dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 d92c5cd5e4e3738ac13e28e55de12e6da1ffda6f8e1c7687e0a0b4092c6b3462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 25KB
        • SHA256 1aec90818ef928b5b6ca252e2ac3ffe4ecc1f169251eba720d0035dcb22ba322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 13328be331666a312d58b6a1b537f8b9ac8922de02e22ddcd0ec84a550e59715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 e45dd01a9f6edcf992f3c74c0eb41178851490db9123a4c738497fbf4f73ec0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\base_library.zip
        • Size 1.3MB
        • SHA256 9f5b9a9b11c385e64462f5a133ca7a3583bd22e5bb21a154cb1af601a03b24de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\ffi.dll
        • Size 40KB
        • SHA256 de64ed1334d84d617cc47a9037b334740e930d75015a768e2825f474782aa839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        liblzma.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\liblzma.dll
        • Size 195KB
        • SHA256 960b67b5188e142ae86e7a3ad0ad417a6c50e7a511b19155ad46061f46d0857f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\python3.DLL
        • Size 68KB
        • SHA256 fc3a7878604878b1144540cb6fb105841170bfb44cd8a4c42e7f3dd8e90b7c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\python313.dll
        • Size 6.8MB
        • SHA256 e1c7a0f81abcb01050fb6c2f31435be16b83d736adf9cbb34bad2325590dc20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\ucrtbase.dll
        • Size 1.1MB
        • SHA256 fbed69a52fdcf571dd37fe4cc63cb86ed3732b5b998807f14968788027c00754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI54802\zlib.dll
        • Size 99KB
        • SHA256 74db91bbc59b23545fd1960ea323f9211fc74434e77e0944056b00d6b05976da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5844-1153-0x000001E6BDDD0000-0x000001E6BF150000-memory.dmp
        Download

        memory/5844-1173-0x000001E6CEB70000-0x000001E6CEB71000-memory.dmp
        Download

        memory/5844-1178-0x000001E6CEB70000-0x000001E6CEB71000-memory.dmp
        Download