Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 22:00
Behavioral task
behavioral1
Sample
Awesomespy.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Awesomespy.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target Awesomespy.exe
- Size 9.2MB
- Sample260716-1ws8dsat5t
- SHA256 490c3fb9be6eb21e919685a32fb013969aeb0ab779449384565992e36886e4f7
- MD5 19bf23ff007008ccc1a775c4f8953d23
- SHA1 bb3078f5108d1666061f74a22d1d56f8a7f941b9
- SHA512 66efd0ac3e7ccb4e88234412bbbc2b77468430b1a5e15bc4536af94f5db1cc7d205c9927e5356206c32d97fd7f12b86a1047ed9d80aed2aedf699faa7588da82
- SSDEEP 196608:fIBEIxttLG2eSNTwhLqiQurHmtXuhHToAUPNfGU5vXvPk0ax8lLsdfGkjz:AGIBLoLqiQuCshHTodRGkXNaxIIZGG
- TLSH T11CA6335A21C15DF8FEB7E23C5402852A97763C521721D6E313D44AE33E236E82D3AB76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 16 IoCs
pid Process 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe 2272 Awesomespy.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2272 1044 Awesomespy.exe 90
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
- MD5 2be172c3086efe56c7e1d3279142295a
- SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
- SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
- SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
- TLSH T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\_ctypes.pyd
- Size 124KB
- SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
- MD5 9314ab9707985aaf6e234b5c1fc3c3c6
- SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
- SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
- SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
- TLSH T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\_hashlib.pyd
- Size 67KB
- SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
- MD5 72b2f8cdf8d6b1dbbdd4e0c0bacf849e
- SHA1 54d10c68abecefa52f866bd13779544616c6b286
- SHA512 827bd7f6aaad7184b3bce810d027055e15818208c8b167ef467bfb21d83103ff24f6d90fe0a500297a93d66d5cddd41eb1cb632f124171b042506a417d5eb15c
- SSDEEP 1536:gksa/wmb96DB9qWptC8SBIWOIuytH/9SfIW44z4r:gHH9qWptClBIWOIBW4IQ
- TLSH T1B3639E0AB6944194D9A78175C9A39F53F9F1F28217206BEF4268C0CD2F233C3A77A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\_lzma.pyd
- Size 157KB
- SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
- MD5 7c25a079b992919cc97221955dac050c
- SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
- SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
- SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
- TLSH T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\_socket.pyd
- Size 83KB
- SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
- MD5 0106ee3f61a54d922190b3a01c81a453
- SHA1 420bd90297b2df30f00813e4ee17177fa0c77c3b
- SHA512 393bb603efa2f1fb783f2a9b898911af0882ff5919c2b3cf615845a349662b7b64d276398187b11f2c5c07a022459dd8d8b41c0ce331bc31c5f088056da7083c
- SSDEEP 1536:BdcydNg46ARGrwISALqwXV9/s+S+pzgMX49IEuDQ6JnlIWLwhmytH/9hjCfIbp:B6ydCA0c6qwXV9/sT+pzgV9IbDTJnlIR
- TLSH T193835A10A6A051FAEB63D075C2639F63FBB4B6C12395935F1092C65E1F33782AE39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\_ssl.pyd
- Size 175KB
- SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
- MD5 ed9242721197fd84231b38e6b42f3f55
- SHA1 4333b9d43a120a6528f63cdba798c8153e8bfdfa
- SHA512 9b4b94f6bf927c07e2e63bc6ee6140ec090c3063dee920d609dc49cb5ce30653ca2e32f4d6f700969082b79b836a276aa1c2fb17cf53f02c2d4f207a1f0d3552
- SSDEEP 3072:l+59j9Gd6wNsBjj903ff6X32RP0o/aC6osf87vOifHZHmziXpIWC7Cz:l+v9Gd6BtGPf6X3fUaC+2Xp
- TLSH T1F2048D47B5841AB7D813E4F9C2234903DBB1F155331257DE48D6E6890F03B4AAEBAB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\base_library.zip
- Size 1.3MB
- SHA256 57ab1a434c06ee4e060bd4de01ea9517401362b1778cbf4c3db5fb9b43276f36
- MD5 2b3ab66457a3999983706177b6029fdc
- SHA1 a32c720ed571927e4f02b1c9fb2f6d59d8088e26
- SHA512 4839be8f7f56f6a778d7eb139d3faff1efc8ba05595dd398eae55f1a34e986d0b965ffa9ccda67505aa1046b013a09ab9a1d413fbbb99ea7b77da15d320d789f
- SSDEEP 12288:LodRL8lJGUma2/HU+rmn9d/s8VNNWHbP1dmRnVTVihlyixmpvQXMHYc9W8:yl8lJGUV2/HX69dBAbP1dmRh/9P
- TLSH T16155D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\pyarmor_runtime_000000\pyarmor_runtime.pyd
- Size 624KB
- SHA256 9185d205e5b7d649ff8e5dfbd3e38595035c8fda558fa0d6157d7dfc2975fc91
- MD5 d7c07ca75c71d587b2ab52eec41db6d0
- SHA1 bc6350f7d882fbad7ce65ec834b0fd9cbfbb6743
- SHA512 6cc942f61a70ea0070b39969bdacf1a1778f2cc53570bbe386cc42ab7b6c60166432bd7ad8ad4d74a4a631944e34a9222118b1f3d457a9752a23ed3e57af107c
- SSDEEP 12288:Jf9xUCjtYwPDcctjdcg7fUoPwTAY7nEP6VB:JlCjctjdcg7fUoPwTAY7n+E
- TLSH T18AD4294BE1FA15D0E6B6E17C078BF2337C3ABA588160775B355CD3A127D4A5222E1F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\python3.dll
- Size 68KB
- SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
- MD5 962428e9e68d43ecc16f3e33f2ea8667
- SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
- SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
- SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
- TLSH T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\select.pyd
- Size 32KB
- SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
- MD5 74b93bc6c37d47011f92024f060c6784
- SHA1 0e9cd2e881ad58818fc75b1fda765841995a92dd
- SHA512 7c92a9c3d676ebf5211b93c7e44cbc77e17925d2ccaba97aa9b52d3fb4050e746ea4a86e82f9553717ddeffade3aaf518563a442578899bc05d65cac57031b58
- SSDEEP 768:gFOLHfEDnlIWQGiOytxJEKrLy2Ip4MTxf1mltPRVugwH:gFOL/EDnlIWQG9ytH/9gfIZRsXH
- TLSH T146E27D8AAB245087F963CA7186A2CE43F939B7E3471146CF30A5D2991E237C1B73A355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI10442\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH