Overview

overview

7

Static

static

3

Rose.exe

windows10-2004-x64

7

Rose.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 07:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Rose.exe
  • Size 45.5MB
  • Sample260626-jcdvxshx2s
  • SHA256 3c7a3d7278af8885b05be29faee31d1ba99bd8268d64101c64a5bf9ed12f91b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 36 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rose.exe
    "C:\Users\Admin\AppData\Local\Temp\Rose.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5948
    • C:\Users\Admin\AppData\Local\Temp\Rose.exe
      "C:\Users\Admin\AppData\Local\Temp\Rose.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1624

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\MSVCP140_1.dll
        • Size 27KB
        • SHA256 d1a0601e781cab04c8dfd46a488ee8dcf3245092532852e2036f1195845c4c4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\MSVCP140_2.dll
        • Size 266KB
        • SHA256 2a0208e4a14e87042469efa481d1f32220bf2a7b7b501173db83c3668fff6669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\Qt6Core.dll
        • Size 9.6MB
        • SHA256 c7f6a8b9f2f4e67e50f37662102be9e987a7a061f882112a4982a2446d83662f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 7b8f64dda29a859755d04622f0dae11282b1598bf027e0b6f4c722e72fc312df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 1ada9f5b3ca6828f1301ce56cf7fc95eb240b53bfdea15a9cef0cfa6b2077389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\QtCore.pyd
        • Size 3.1MB
        • SHA256 d2bd091416eb60b1fd051cc65a42f3efd4db5521b1f1479bba11d44c4d537125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 c2767ba411264cade8698b7fbc089943b5ddbb141ec6a4bbeab56af51320c88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 e09a727f70d027c5dcef08e4bb1c2016d47550104e3ebf3cc1fb36787b1403e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\PySide6\pyside6.abi3.dll
        • Size 254KB
        • SHA256 668d2e42c5afbf9c9a2caec299694ad51ff4d67e962f18cd745382a8b6e3dfb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\VCRUNTIME140_1.dll
        • Size 35KB
        • SHA256 b1d3b6b3cdeb5b7b8187767cd86100b76233e7bbb9acf56c64f8288f34b269ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_brotli.cp39-win_amd64.pyd
        • Size 861KB
        • SHA256 093ab305d9780373c3c7d04d19244f5e48c48e71958963ceca6211d5017a4441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_bz2.pyd
        • Size 84KB
        • SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_ctypes.pyd
        • Size 124KB
        • SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_hashlib.pyd
        • Size 64KB
        • SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_lzma.pyd
        • Size 159KB
        • SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_queue.pyd
        • Size 28KB
        • SHA256 3bc50ac551635b9ce6fbcddea5d3d621c1216e49e9958fa24546ab8f6f2d111a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_socket.pyd
        • Size 78KB
        • SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_ssl.pyd
        • Size 151KB
        • SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_uuid.pyd
        • Size 22KB
        • SHA256 6f1cc2d6a770f1b441dc6371decae414ea1bd509b0e37b423faa33fc98a28b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\base_library.zip
        • Size 1012KB
        • SHA256 e0d3cfcaf8aa2fe1ab86db7ebf996d02c4e53eafab24c9a42371d33c52c81c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libssl-1_1.dll
        • Size 674KB
        • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\pyarmor_runtime_000000\__init__.py
        • Size 103B
        • SHA256 037823142b19fb9de0db360b2f920e9f0f12197245f15eae82fdfda60973c0c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\python3.DLL
        • Size 58KB
        • SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\python39.dll
        • Size 4.3MB
        • SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\select.pyd
        • Size 28KB
        • SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\shiboken6\Shiboken.pyd
        • Size 33KB
        • SHA256 1bbb27747949b24bc0f6176be73188ef77a83e9db0ac2f933da1b0b7b5e6cb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\shiboken6\shiboken6.abi3.dll
        • Size 373KB
        • SHA256 0fe96e805a6001efde58818a1ce6cb425227f74be72f3b10d7c06c7435fefa5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\unicodedata.pyd
        • Size 1.1MB
        • SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1624-186-0x00007FFFD4190000-0x00007FFFD463D000-memory.dmp
        Download

        memory/1624-194-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-187-0x00007FFFD3B40000-0x00007FFFD4186000-memory.dmp
        Download

        memory/1624-189-0x0000022022960000-0x0000022022970000-memory.dmp
        Download

        memory/1624-173-0x00007FFFD5CE0000-0x00007FFFD6005000-memory.dmp
        Download

        memory/1624-190-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-191-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-192-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-193-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-181-0x00007FFFD4F70000-0x00007FFFD5325000-memory.dmp
        Download

        memory/1624-195-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-196-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-197-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-198-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-200-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-201-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download

        memory/1624-203-0x0000022021470000-0x0000022021E16000-memory.dmp
        Download