Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 04:14
Behavioral task
behavioral1
Sample
srv3-windows.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
srv3-windows.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target srv3-windows.exe
- Size 7.9MB
- Sample260710-et2wvscy6j
- SHA256 cd6fb6592130e25c0a098c87d984126e61bbe5d568cfea2aa7a169f13213138b
- MD5 76233a8f7a5b2d745e623d8e3fa904f1
- SHA1 54aa52af07d8d0266386be84a1e87a728d3f5cc4
- SHA512 c469f648b9190e3adf257dc18b1c26c29316a273da4ce9b4c8311ac263e852252474c638cef94b592581088a129cf2f1b2b71f1f5fff25d260341ad95eeb2b20
- SSDEEP 196608:4Qr2eBNTwhL5jHRNurHSuhHToAUPNfGU5vXvPk0ax8lLodIOZ+:XsL51NuXhHTodRGkXNaxI0PA
- TLSH T1958633A662C558F8FEB7D63C9A238128D3763C860721C5D703E58A933E271B43D39766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 1724 srv3-windows.exe 1724 srv3-windows.exe 1724 srv3-windows.exe 1724 srv3-windows.exe 1724 srv3-windows.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1724 1672 srv3-windows.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\srv3-windows.exe"C:\Users\Admin\AppData\Local\Temp\srv3-windows.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\srv3-windows.exe"C:\Users\Admin\AppData\Local\Temp\srv3-windows.exe"2⤵
- Loads dropped DLL
PID:1724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
- MD5 2be172c3086efe56c7e1d3279142295a
- SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
- SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
- SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
- TLSH T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\_lzma.pyd
- Size 157KB
- SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
- MD5 7c25a079b992919cc97221955dac050c
- SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
- SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
- SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
- TLSH T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\base_library.zip
- Size 1.3MB
- SHA256 9cc0d943d6b9b3acbb2befe108c73d05af2e01ceba6117585bc99e4a6ce63f06
- MD5 4551461a2cefa030c4876d6d1d634126
- SHA1 cca50ba4404dad4ad3a06130174a061eac4fc453
- SHA512 5e8f35cb015054d31ff6e6479649a9faf699aba37f580c406acf6a8a374638adf31327c8a8dcb5a5ba9a5ec1700e71b46a19b631f21ee6fa00b0f1a341545fdd
- SSDEEP 12288:sLnVTVihlyixmpvQXMHY7z8lJGUmx2/HcNBR3rmn9z9WnHbP1dmaL/s8LW:AhQ8lJGU+2/H8969z9ebP1dmEvW
- TLSH T18255D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH