Overview

overview

7

Static

static

3

ExcelSQLStudio.exe

windows10-2004-x64

7

ExcelSQLStudio.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 15:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ExcelSQLStudio.exe
  • Size 58.7MB
  • Sample260715-s683labs4x
  • SHA256 0a41c87ed83a4f78b467d22d32445dd20159ec9160f5ca4dac238a9efd1db858
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ExcelSQLStudio.exe
    "C:\Users\Admin\AppData\Local\Temp\ExcelSQLStudio.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\ExcelSQLStudio.exe
      "C:\Users\Admin\AppData\Local\Temp\ExcelSQLStudio.exe"
      2⤵
      • Loads dropped DLL
      PID:4484

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\PIL\_imaging.cp314-win_amd64.pyd
        • Size 2.4MB
        • SHA256 82ae998248c6785a4101e98b8c85a598d51df8f951ce3759ac27ede43b763467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_bz2.pyd
        • Size 85KB
        • SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_ctypes.pyd
        • Size 138KB
        • SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_hashlib.pyd
        • Size 67KB
        • SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_lzma.pyd
        • Size 157KB
        • SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_queue.pyd
        • Size 35KB
        • SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_socket.pyd
        • Size 85KB
        • SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_ssl.pyd
        • Size 179KB
        • SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_tkinter.pyd
        • Size 67KB
        • SHA256 4795b085668e6c37f4ffa281a89aeacff871288b1a2a88365d633b37576722c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_wmi.pyd
        • Size 39KB
        • SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\_zstd.pyd
        • Size 491KB
        • SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\base_library.zip
        • Size 1.3MB
        • SHA256 aa4f5245ef64b6d897382f2549f9ea7199f9427fde89f93c8fa1f1a2e2ece24e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\customtkinter\assets\themes\blue.json
        • Size 4KB
        • SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-9e3e5a4229c1ca39f10dc82bba9e2b2b.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy.libs\libscipy_openblas64_-9e3e5a4229c1ca39f10dc82bba9e2b2b.dll
        • Size 19.5MB
        • SHA256 9e3e5a4229c1ca39f10dc82bba9e2b2bf48037790932566f37aff1a7ccf3588f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
        • Size 4.3MB
        • SHA256 d8671a58aa9cce22e3b5b17b9ae36958cc977c0f9599ce41fff6efee77c698f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
        • Size 109KB
        • SHA256 8a9fd1d93ef4fdf387ac7efe13406e8c4192a6269f9b3443f3e6cbe3b06368cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bounded_integers.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy\random\_bounded_integers.cp314-win_amd64.pyd
        • Size 210KB
        • SHA256 752c478d5894e8edbd4a2c52baa54b6a64c487c8001b9c4e96e407d5e2324103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _common.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy\random\_common.cp314-win_amd64.pyd
        • Size 161KB
        • SHA256 f1249fa6fe412ba9889aa538d29bb5d8b2e7f43a7e7b85e4bc6193c2d5a9f9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _generator.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy\random\_generator.cp314-win_amd64.pyd
        • Size 583KB
        • SHA256 1daa87ed919df09d35716de5b1815a835749c0ea87320fc05e8ae090f345bc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bit_generator.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\numpy\random\bit_generator.cp314-win_amd64.pyd
        • Size 157KB
        • SHA256 84f44545c6ddfe1273ed5d9baf5d6cd40602a9d3755e2875b9dc19ebb22c5de4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\python3.DLL
        • Size 72KB
        • SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\python314.dll
        • Size 6.4MB
        • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Conakry
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Africa\Conakry
        • Size 148B
        • SHA256 d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Djibouti
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Africa\Djibouti
        • Size 265B
        • SHA256 c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Kigali
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Africa\Kigali
        • Size 149B
        • SHA256 444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lagos
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Africa\Lagos
        • Size 235B
        • SHA256 cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Curacao
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\America\Curacao
        • Size 246B
        • SHA256 8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Toronto
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\America\Toronto
        • Size 3KB
        • SHA256 a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EST
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\EST
        • Size 182B
        • SHA256 91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Greenwich
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Etc\Greenwich
        • Size 114B
        • SHA256 6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
        • MD5 SHA1 SHA512
        Submit Download

        London
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Europe\London
        • Size 3KB
        • SHA256 c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Oslo
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Europe\Oslo
        • Size 2KB
        • SHA256 5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Skopje
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Europe\Skopje
        • Size 1KB
        • SHA256 3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MET
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\MET
        • Size 2KB
        • SHA256 812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PRC
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\PRC
        • Size 561B
        • SHA256 64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Wallis
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Pacific\Wallis
        • Size 152B
        • SHA256 53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Yap
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\Pacific\Yap
        • Size 172B
        • SHA256 9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UCT
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\UCT
        • Size 114B
        • SHA256 8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
        • MD5 SHA1 SHA512
        Submit Download

        Mountain
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\pytz\zoneinfo\US\Mountain
        • Size 2KB
        • SHA256 32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\tcl86t.dll
        • Size 1.8MB
        • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\tk86t.dll
        • Size 1.5MB
        • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\unicodedata.pyd
        • Size 740KB
        • SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\zlib1.dll
        • Size 142KB
        • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4484-1964-0x00007FFB24260000-0x00007FFB24289000-memory.dmp
        Download

        memory/4484-1965-0x00007FFB0F220000-0x00007FFB1059E000-memory.dmp
        Download