Analysis
- max time kernel
151s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 13:32
Behavioral task
behavioral1
Sample
kiosk_player.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
kiosk_player.exe
Resource
win11ltsc2024-20260706-en
2 signatures
150 seconds
General
- Target kiosk_player.exe
- Size 86.0MB
- Sample260708-qte8msf12z
- SHA256 2ccdb91656f1949dbb7b56e7aa00e1ccf6f67d0dc96514dab1250cd588154bfc
- MD5 49e0f0107a4764affb7621652ea2c347
- SHA1 e231fd39522c512e7a5001d955234c5eaba7a5c0
- SHA512 edfb5d7efee5ac66fbb6d1cc2f8498642c0a480efefb6f7cda08d2341e35b418239e1691b807405ca784d05845b96347057b930fbcd2c19a80fb72193a53f0e9
- SSDEEP 1572864:oWBlm4VOeoiN/XcYvo9hfnJMHuto2frYuDn6fRH/G/nCKaWm7XKOcC0QSuLl/G:o27zNfcOo9AHQ9TOfRH/E4Wm7aAV
- TLSH T14618336DB9E94079E03E2AB434C21256B7A334159B61C08B8B26C7E15BF37943FB0B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
pid Process 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe 4956 kiosk_player.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4956 2136 kiosk_player.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\kiosk_player.exe"C:\Users\Admin\AppData\Local\Temp\kiosk_player.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\kiosk_player.exe"C:\Users\Admin\AppData\Local\Temp\kiosk_player.exe"2⤵
- Loads dropped DLL
PID:4956
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
- MD5 2be172c3086efe56c7e1d3279142295a
- SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
- SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
- SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
- TLSH T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\_lzma.pyd
- Size 157KB
- SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
- MD5 7c25a079b992919cc97221955dac050c
- SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
- SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
- SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
- TLSH T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\_tcl_data\encoding\cp1252.enc
- Size 1KB
- SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
- MD5 e9117326c06fee02c478027cb625c7d8
- SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
- SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
- TLSH T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\_tkinter.pyd
- Size 66KB
- SHA256 ed2f7b2c9984032cfb046923b45bb745f6e819730c086e559777665b45e8390e
- MD5 7184d0da3bc7000ff02f3ca417924866
- SHA1 c6862df017f8f6234f89b1fcb12f87660d644ad3
- SHA512 ece03c7a9411a1bdb0b92378b4234ed9af69ee486a22e58463fd9b9c8a7805dcae45445fe831840c14476ab1346b142b8bbed76cd2f1588549377a4ee981f5c8
- SSDEEP 1536:sibeqllslpw+Tq0W6/glU9owEVl3e+BIWOS3ytH/9sfIbR:siFTN+u0W6/glP3Vl3e+BIWOSUF
- TLSH T190638F9BA7A4008ADEA3C539C5779F13E575BA920A10A34F01E4D34A2F337E393AD714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\base_library.zip
- Size 1.3MB
- SHA256 e5bb59ef7fc6d616ed31f807b58ac701b34c48f84b9ff9088a3391f8bdae3e46
- MD5 58b5c67986b8fed7653ab863824b9214
- SHA1 8e71dfc31717e172edaacfe06f57b5306de78ab8
- SHA512 34b31dfdc796f8fcc663b4582acb5e405748b5928f6f341ec294079f702a463b6172a09dbe9a826c2fe7e8054a0928a0019cfc57bbc13d210cf47c1054dd8448
- SSDEEP 12288:iHbP1dmrlnVTVihlyixmpvQXMHY28lJGUmmRuVNI9Wd2/HA/sF+rmn956L:obP1dmRhL8lJGUpd9U2/HAJ69sL
- TLSH T1EC55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\locale\el\LC_MESSAGES\vlc.mo
- Size 831KB
- SHA256 bb789f25320a3fe05409db15406814da1f9c0c37c9aecf610bf24de4a423182d
- MD5 054b5d736d33495a8a84e93215a81f34
- SHA1 4a6b974f1dd9378e90e036aeb1699f23d46c140c
- SHA512 d006f08cf0d9ff70f42aff06201139aca416a1c396584e931017be15894af0eed0a010e5d2266e9ce5eb5eb472ee5b6e8f226030e9a9e1abf447f348584da393
- SSDEEP 24576:Q8tnPK5WIaeLIbAKrBMf/GlKdFUBRNTW9dTKaPJS9XK70/mA:XK5TaeLIbAKrOf/GlKdFUBRxW9dTKaPU
- TLSH T1F80596DFF5542EAEC089503785E8A07837A65D2C9709CBD8753DCB707EEA0619622E0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\tcl86t.dll
- Size 1.8MB
- SHA256 b894e0c9a7d2b56f9f202de5044221cfc0938cbd9ffaca6b6793bba486e28081
- MD5 10fe860df8a1952e1eb794a9c1a76e55
- SHA1 bb998de5efa9f16fe71d617dedcc778dda899789
- SHA512 a63983d81f3299d66dd888f798e71f66e942291f5b765185b1efdd99db48034d12d21e2e3440ed471acfbf5d3e220c68580f3d86e9f1c60894780379361fbf70
- SSDEEP 49152:N0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGe:+BUqMR7i6x9T+e
- TLSH T105859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\tk86t.dll
- Size 1.5MB
- SHA256 3883976d6270c44cf43b0f4e3b925259a36c42f586680a93dfe6a3fdfb5b4939
- MD5 58b94fa5c20956a4b2de750cce8681aa
- SHA1 75e0a64275f2f0919cf1eadccbad41dc81705d2c
- SHA512 e517f132d5b2b28b65963db76aad9d00dc02c5c9513a38db9deb1d003d19db0f1b671c486e5cc2cb4a1d5eb9e977ea1ccc7c3f214e98461b38dd085429fb2113
- SSDEEP 49152:176DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezfG:SQchLNqaJvARxr9DrTwylL1y5BEq8JTR
- TLSH T1EB754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21362\zlib1.dll
- Size 144KB
- SHA256 a3a9487dd7a27be0296731513a5c1d9005bd3acf5861ccbe0aabca3984f51c4f
- MD5 4d802db6ab2f497b2ce6b2f836543fe2
- SHA1 7887e35709b01b489269b5ca123d198c012f8fa6
- SHA512 3a5627d09e880eb70419c1e8e8cce4403a5213d5162a500bd6b973bf31fab3427c83195190233ff2697a13ab3082621825a6c8123153f835a67090eeed6d819c
- SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJC2KdT:0sVD+RrFgvi7JuT
- TLSH T1B4E37D9BB6A225BDC677817042E6C776F932B8214B3099EF5088D7741A12F806B197FC
- MD5 SHA1 SHA512 SSDEEP TLSH