Overview

overview

7

Static

static

3

EasyAntiLoader.exe

windows10-2004-x64

7

EasyAntiLoader.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 00:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EasyAntiLoader.exe
  • Size 35.7MB
  • Sample260627-abbvhafv2s
  • SHA256 5ffd6fd1673aacd31f8fb26274aa4f09ecd37ed174c595b4ec803694de86ad86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 40 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EasyAntiLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\EasyAntiLoader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Users\Admin\AppData\Local\Temp\EasyAntiLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\EasyAntiLoader.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
        • Size 214KB
        • SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\PIL\_imaging.cp312-win_amd64.pyd
        • Size 2.5MB
        • SHA256 6dfd10a98bc81a1999e2b5ddb8be8c1cfb9a2c8e10258c56a52ee0d8930d3d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_asyncio.pyd
        • Size 69KB
        • SHA256 0d4fbd46f922e548060ea74c95e99dc5f19b1df69be17706806760515c1c64fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_brotli.cp312-win_amd64.pyd
        • Size 836KB
        • SHA256 1e4cf067342ee168410560db9bbba370a1b609abc028bff61a3dcc1274dfcd16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_bz2.pyd
        • Size 82KB
        • SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_ctypes.pyd
        • Size 121KB
        • SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_hashlib.pyd
        • Size 63KB
        • SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_lzma.pyd
        • Size 155KB
        • SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_overlapped.pyd
        • Size 54KB
        • SHA256 5d298bb811037b583cff6c88531f1742fae5eee47c290adb47ddbd0d6126b9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_queue.pyd
        • Size 31KB
        • SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_socket.pyd
        • Size 81KB
        • SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_sqlite3.pyd
        • Size 121KB
        • SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_ssl.pyd
        • Size 173KB
        • SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\_wmi.pyd
        • Size 35KB
        • SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\base_library.zip
        • Size 1.3MB
        • SHA256 731321a301472be38660d27a92b0e214a105071c8d2dc80eab14ba69077d946b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\charset_normalizer\cd.cp312-win_amd64.pyd
        • Size 10KB
        • SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\libssl-3.dll
        • Size 771KB
        • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\multidict\_multidict.cp312-win_amd64.pyd
        • Size 79KB
        • SHA256 a7411fadf931b119427b537fcc6467f63179a7a7c29c603b89b1bc8be0733f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\python3.DLL
        • Size 66KB
        • SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\python312.dll
        • Size 6.6MB
        • SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\pywin32_system32\pywintypes312.dll
        • Size 133KB
        • SHA256 b29e4098f9f53f05e3281636d079de58b05a26c03669cea4ec1673e51750fa31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\select.pyd
        • Size 30KB
        • SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\sqlite3.dll
        • Size 1.4MB
        • SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\ucrtbase.dll
        • Size 987KB
        • SHA256 c446df8432ff2679961763de876432fcf13f272269c17417e7eccbda0b000448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\unicodedata.pyd
        • Size 1.1MB
        • SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\win32\win32crypt.pyd
        • Size 122KB
        • SHA256 6d625fbac4e15b0310f19fffc656357eab024132fc514bd587d811d106bc704e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37242\yarl\_quoting_c.cp312-win_amd64.pyd
        • Size 81KB
        • SHA256 3a788a9fc9468ca4d63342e066bce958c973446a8a3dead2656e50d198e203de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download