ab290f1a12bbd4526ef44ce87cd88a3babf0ec604cc64fcc43eb32bf4351b45d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decrypt.exe
Size 4.7MB
Sample260628-amltvaev5m
SHA256 ab290f1a12bbd4526ef44ce87cd88a3babf0ec604cc64fcc43eb32bf4351b45d
MD5 2c037dd206414acbdf7d08604cb41676
SHA1 a30fef9be32c98a6be2bcfca38192434c1fa439e
SHA512 3237c9c269fe60ed4ec85ac52220d1f810758ecba0e859794702c11de780c0818915452aa8802cacfd27b790b1d52768fb055b819353e768a9f0bb1826ab6a9e
SSDEEP 98304:DMiKUYtizuTxI6OibE913yyN/R7d64P7W+emKY750J6xiEtZQWsewkKJ:DpkiOI69Abi+RhW+eSGJDXWs6K
TLSH
T15036334A99350E5ADE26C07FD5E3C832B8313C2D17625BE766C0E5333942F962E9D1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
5044	decrypt.exe
5044	decrypt.exe
5044	decrypt.exe
5044	decrypt.exe
5044	decrypt.exe
5044	decrypt.exe
5044	decrypt.exe
5044	decrypt.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	decrypt.exe
5044	decrypt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 5044	1776	decrypt.exe	86

C:\Users\Admin\AppData\Local\Temp\decrypt.exe
"C:\Users\Admin\AppData\Local\Temp\decrypt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\decrypt.exe
  "C:\Users\Admin\AppData\Local\Temp\decrypt.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Crypto.Cipher._AES.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17762\Crypto.Cipher._AES.pyd
Size 30KB
SHA256 9072e92e648e4049a3cccb981ac3b5c97114dac0dc69e94daaa5a6b0f75b2fbf
MD5 fee0d3b5e4d558b7f50b39a39a6c22fa
SHA1 8de9c523389e6efb8c57dd8cd9ae1ea667b03f1a
SHA512 a74009f18291ceeed1bfb55cb05ff9fb88d4549f6c82e792f9ea2bf451728989e427efa5e40916dc031e05234dcae8f56c791f8067b578b5e61e1e16167c4419
SSDEEP 384:/je1Ow5cJiQhvAMs2WdMnkkLtu37usOo8Vd6IHiPKDkAKB5F0lK0pLCQRpM:/y75/+o9CkkQahoICS4AIoL
TLSH
T1C3D28D4476281AE7EC4613BADA226D1BF87C7C394B15F1FF849483C32A176E47636943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crypto.Util._counter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17762\Crypto.Util._counter.pyd
Size 10KB
SHA256 eea2d7e4436e6907fa1db6204ef525e5ea21cfbf3151e2e00fda83d8d860b462
MD5 1d2a5bbfe1b75bab56178cb8ad1276b5
SHA1 db5e86f806b4c11c97197a4bde3be2211fa4de33
SHA512 3a9984128a7330dfbbf0364e562816acbd9842eca2bf43a54ae42d561770745db516820d965464787b21858b635e41fdaecc2c91abddd733ba345f269c95964a
SSDEEP 192:63nZ/nGOyfOedYq0wC8SShMjLdUbOQKOd43XyKY:63nZ/GOyfOBqrC8SShMjLdedKOdICj
TLSH
T19E222967A6181061E737D23CED538A13E139B5A1679963EF40E143591FA35E386BC348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17762\_socket.pyd
Size 49KB
SHA256 4e06766f7679b824f40afe07985dda0c26718ff2f9eddecf412dde5ee4a19249
MD5 d2331f27c43c5bacd203c1a9fbd0057f
SHA1 33f17a65381d1ef0d683c7ccead67c12ee40ea3d
SHA512 d901cba774f1c0b3e8c221909fab0d8cffeb84c761b92702655900a9cfec735fa19d870c8a5b1ffb326b922b23480fbb5de842d9bc25d260c38f5d46aafcfc72
SSDEEP 768:oxz7mVR45ePJmAv/FO/yOhupnXJnzWGFH+rr7RHF4sN7us1e9lBOmyBQ:oxzkR45ePkAlO/du7H+rrlHF4C7febM
TLSH
T19D334B11E62281F9E667C0B5C6231B63F27438A413AC37DF4560C5692F236D1BE7ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17762\_ssl.pyd
Size 2.0MB
SHA256 a2c27832e0e73aaecb501edaf594a74ccde2c9fe74912607644c664dce0e8c39
MD5 c0f47eeac56cf1a8a2e8904ba5344b97
SHA1 11611fa852f241ff73b2df286d60810efb146106
SHA512 83cdb282856138756fd7412bb8b40bbc097c1763ab625d73711e9d8d3f7b73ebba66f956ab942b57e59de6e5d9c454ec2d5d90c2ff7e58c68857718e2763932e
SSDEEP 49152:BlK8bFdyjSAPrwsEHCesozmGtlqsYKVwASOQtMp5k59U:/KU37ztsMk5
TLSH
T191A58C46F2A400E4D6BBD27CCA27862BE7B1B40C1370AFDB426186692F53BD5563E74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decrypt.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI17762\decrypt.exe.manifest
Size 1015B
SHA256 c66a6dfd70b89b0bc19b982c0aac52a9626b7869fcba0642308a3aa35de870d7
MD5 bd481c2264befefcb67f14ff6aad732a
SHA1 673c81559df226c9371cfe4abb3cca44a80bec7a
SHA512 30b21c48e23e923a0634e795296eac35688f386ae34203aaa0c5c8b63b1ee3c1fe821bff745fd1cde0c4c0134c764e70c7e13050bff45b41ed9801c8e131679f
TLSH
T12911E100C8C8D862F73205D33360ED49DE59A7BB488C469DB48D7B6F4B13ED48253168
MD5 SHA1 SHA512 TLSH

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17762\python27.dll
Size 3.2MB
SHA256 75bd6533c64b50ee970bc0484d1c490f4c65b4b30cf734d0778c1bb7ed84887b
MD5 5a1a820dd6db24e28084ce4b2f286147
SHA1 a9c0112f183ccd05fb8b5e423bcd5dd39d49312f
SHA512 7bc30495440f7d96c0f6155bb286d2ed35f97266bde7eabac81897e6d4f5d57a1608a865a99412178640e46eb63be4f3dac1e48bff3fa4421edf5371e8d57242
SSDEEP 49152:CnznL4bV4eEBjnziKSLi/1S+iXP/nxMcAHxBFI7Tll8+e63w:8VonznxMFHDqQZF
TLSH
T1D3F58C46A36720A5DBB7C878CD069642D271BC742B2D73CB0564B7AA6B33DE3067E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17~1\_ctypes.pyd
Size 118KB
SHA256 b21637ce6acd18dfe911a0392f491da9dca3787f66fb8ad0b50eabc2ec37c1f9
MD5 e15a8623d227db645c00a731f45ff339
SHA1 191997f0ab3fc7b209f8ac948fcb866f2193dc57
SHA512 5d1f24d8c77c66ec055a9ff51366743a87aacedcdfd004f7d9ed75990dd7906a27dde0f432c21cf2d9db4eb0e1968212b71571c47e5f39ba5a04de75aca3a752
SSDEEP 3072:KlbnlERmdzOZqJhs/85nFdSLrLu3e1LW40k6ft1nFDsC:Kw8dzOZqMWFYLrLae1Lwft1nR
TLSH
T1CBC32A4A33681198E7F2517CC821AE52DB327469131153CF0664C7AA2FD3ADB7DBE788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17~1\_hashlib.pyd
Size 1.4MB
SHA256 0c9013b02b5bbcd694300c230b310179588191f6154398d10b86f972b5a946ac
MD5 5af923146b2224a468044e5e215cf3c5
SHA1 23faf7f46072746443c8ef5c5b26d050fd612a21
SHA512 d1a1029c44f52729cfa066dc19cc927aae7d070a227850a1051da27f08ba7654717f1d35946642ca3af3c6c37249dfa58447fb9544d102ae5d1bccd665bc0da6
SSDEEP 24576:bXYH5GjSFHJLZehN2wKWQUk1cDTsLLqZGtlqv315npk2f6J8e:jGcjSdaMUUAbZGtlqPnpk1F
TLSH
T117657C56B2A001D6DABFE238C5574A2BE7F1B4081330AFDB66619B692F13FD5523E304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5044-25-0x00000000006A0000-0x00000000006A7000-memory.dmp

Download

memory/5044-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download