Overview
overview
6Static
static
5meccha.rar
windows11-21h2-x64
1meccha/EOS...ng.dll
windows11-21h2-x64
3meccha/EOS...ng.dll
windows11-21h2-x64
3meccha/OnlineFix.ini
windows11-21h2-x64
3meccha/Onl...64.dll
windows11-21h2-x64
1meccha/Pen...ng.exe
windows11-21h2-x64
6meccha/Pen...el.exe
windows11-21h2-x64
1meccha/dlllist.txt
windows11-21h2-x64
3meccha/winmm.dll
windows11-21h2-x64
1Analysis
- max time kernel
119s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/07/2026, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
meccha.rar
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
meccha/EOSSDK-Win64-Shipping.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
meccha/EOSSDK-Win64-Shipping.dll
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
meccha/OnlineFix.ini
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
meccha/OnlineFix64.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
meccha/PenguinHotel-Win64-Shipping.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
meccha/PenguinHotel.exe
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
meccha/dlllist.txt
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
meccha/winmm.dll
Resource
win11-20260513-en
General
- Target meccha/OnlineFix.ini
- Size 648B
- Sample260701-eftckafx9t
- SHA256 f3396767978d24f77e95b179dcc4afa073689a0d86b3e0491fde74e4ad355760
- MD5 5b3e0cff313418be4c96c1631dd53ea7
- SHA1 bc9ac4dfee843439b2bacad08938b3aa38f26f61
- SHA512 8c868662d7a49921e5c73beec57a92e4b3396a84cd0912536cfdcf03d31aa13016a20342376fae1f135248eccdbb31baae7dba6d0034b679769df8bf7a11791b
- TLSH T1B4F002D83DAF7A78C6A30A3CBDC39C4BA5DDB556B20F1944B4820EC6283ED00516470C
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1344 OpenWith.exe