Overview

overview

7

Static

static

3

RCE Generator.exe

windows10-ltsc_2021-x64

7

RCE Generator.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    72s
  • max time network
    7s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/07/2026, 22:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RCE Generator.exe
  • Size 8.7MB
  • Sample260713-2lnetsb19v
  • SHA256 92b157956b6ca5a9cd3ab0ec5c02ddd642ce3002cfb469c14b644c48add6ff15
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 20 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe
    "C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe
      "C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe"
      2⤵
      • Loads dropped DLL
      PID:4584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_bz2.pyd
        • Size 82KB
        • SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_hashlib.pyd
        • Size 64KB
        • SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_lzma.pyd
        • Size 154KB
        • SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_queue.pyd
        • Size 31KB
        • SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_socket.pyd
        • Size 81KB
        • SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_ssl.pyd
        • Size 173KB
        • SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\_wmi.pyd
        • Size 37KB
        • SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\certifi\cacert.pem
        • Size 277KB
        • SHA256 2b7b1026f18a297e2148189ca0cbe7d3e7f9efc36f7231ccc2820a404feb5596
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\charset_normalizer\md.pyd
        • Size 10KB
        • SHA256 465eea55e33d0d18fc859bb2a324236912ac67ace4a688dbecdc759cd4db8ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\charset_normalizer\md__mypyc.pyd
        • Size 123KB
        • SHA256 5972250796d99115d8da4e2bef43e6c9fede2d1c3accb89bf9d5d791122b3990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\python312.dll
        • Size 6.6MB
        • SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\select.pyd
        • Size 30KB
        • SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\unicodedata.pyd
        • Size 1.1MB
        • SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\vcruntime140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wheed_protected.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\wheed_protected.dll
        • Size 14.0MB
        • SHA256 66da58007df52599e4331be2b3109465e9bf1ad96d16a5627456465e7a05e331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backend_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2768_134284560283593258\zstandard\backend_c.pyd
        • Size 508KB
        • SHA256 641e0b0fa75764812fff544c174f7c4838b57f6272eaae246eb7c483a0a35afc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2768-88-0x00007FF7E4660000-0x00007FF7E4F3D000-memory.dmp
        Download

        memory/4584-89-0x00007FF7E4660000-0x00007FF7E4F3D000-memory.dmp
        Download

        memory/4584-91-0x000001E0B1FF0000-0x000001E0B24F3000-memory.dmp
        Download

        memory/4584-90-0x00007FFD1B740000-0x00007FFD1C56C000-memory.dmp
        Download