Overview

overview

8

Static

static

3

trester-gdionly.exe

windows10-2004-x64

8

trester-gdionly.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    42s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/06/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    trester-gdionly.exe
  • Size 20.5MB
  • Sample260624-vrprhsdy7w
  • SHA256 927046f7988e0f1b9bcde01e2d398a9b669e63ddd6c50219b7a7ac61090cadc2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasion

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Loads dropped DLL 18 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trester-gdionly.exe
    "C:\Users\Admin\AppData\Local\Temp\trester-gdionly.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5516
    • C:\Users\Admin\AppData\Local\Temp\trester-gdionly.exe
      "C:\Users\Admin\AppData\Local\Temp\trester-gdionly.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM svchost.exe
        3⤵
          PID:3476
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM svchost.exe
            4⤵
            • Kills process with taskkill
            PID:7096
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1128

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_bz2.pyd
          • Size 85KB
          • SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_cffi_backend.cp314-win_amd64.pyd
          • Size 177KB
          • SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_ctypes.pyd
          • Size 139KB
          • SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_lzma.pyd
          • Size 157KB
          • SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_socket.pyd
          • Size 85KB
          • SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libportaudio64bit.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll
          • Size 300KB
          • SHA256 ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_wmi.pyd
          • Size 39KB
          • SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zstd.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\_zstd.pyd
          • Size 491KB
          • SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\base_library.zip
          • Size 1.3MB
          • SHA256 f46b55a8f3a9789af238a04d0514b334731aa6b7d882ddc4ca5620397b09a674
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\numpy.libs\libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
          • Size 19.5MB
          • SHA256 63c857e738469261263c764a36be9436ebdeaa272e340a828f42047a97131080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
          • Size 561KB
          • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiarray_umath.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
          • Size 3.6MB
          • SHA256 c4d8aa9b07deebc0f6e437098c1c3055145f7d810af770453f9cd74452b9d96a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _umath_linalg.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
          • Size 109KB
          • SHA256 ec000e9fdc121f44449a123080819ec28ee696b093c5c71f1ca802e9f88392e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python314.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\python314.dll
          • Size 6.5MB
          • SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes314.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\pywin32_system32\pywintypes314.dll
          • Size 133KB
          • SHA256 74f036548f3321d312205085662b2b92c0654354a718a41c44e02fd4e01fedb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32gui.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI55162\win32\win32gui.pyd
          • Size 217KB
          • SHA256 7aa66fcce2e873d5c48f3956d0398d27fb6420c8a68a2a8bc74f0622edf93571
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4808-108-0x00007FFDB7530000-0x00007FFDB88B1000-memory.dmp
          Download

          memory/4808-110-0x000002369A660000-0x000002369A661000-memory.dmp
          Download