Analysis
- max time kernel
149s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 21:49
Behavioral task
behavioral1
Sample
Disolated.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Disolated.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target Disolated.exe
- Size 19.9MB
- Sample260717-1pcbasex5n
- SHA256 2d39723ac8e20d544975325348f7e8d76b7fee9dea40e7fe0a786ea245aa6168
- MD5 1dce81baace228aa358c9ec981fc3e7a
- SHA1 47d832f2440dbac8348d1d573917f79e6f6d3a5e
- SHA512 589a61d2b39c6f9f0daf3aaf55bbaf29b30fdab86213a9ffa61ed9a354cea18af87683e97dc389a5e8e5d9b106c3375bac4c8ae700845c591164d42f3875ef72
- SSDEEP 393216:Sbiodjs14bMgLc9zGdGthRBnK30kgIfUKOcwrYtZq5XchEHsGXuE7QI:v2G4TLcNOijs58KPwrYtZq5IWtXv
- TLSH T182273344A7D028E7F8A7953886E7C516A2B1B2345F50C9DF26A2436D3FB3381046E77E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 16 IoCs
pid Process 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe 1456 Disolated.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1456 Disolated.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4156 wrote to memory of 1456 4156 Disolated.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Disolated.exe"C:\Users\Admin\AppData\Local\Temp\Disolated.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\Disolated.exe"C:\Users\Admin\AppData\Local\Temp\Disolated.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_bz2.pyd
- Size 86KB
- SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
- MD5 28cea50945ec6972c8ec096bf562fb9e
- SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
- SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
- SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
- TLSH T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_cffi_backend.cp314-win_amd64.pyd
- Size 177KB
- SHA256 2011ed3465ee2b732588c443c246f9c857288b8a0c59ea737100d230a5f8e346
- MD5 4602c944a730c8c1405e5766414e293d
- SHA1 2d0a3a8ea13b9cefec438d5f46c383fc6ac2f25a
- SHA512 b2771b13fb58cba2da29cf99dea7fd94e716771f09670f90a872982c3c3a1c8a1a52116ce0b4ab3570f85bb5e2173e1d10f7106a57ff75fa5c85b0a0c089ddfa
- SSDEEP 3072:0pRFTWFsUf+5WcuCXwtzqEXfUMaAUUjjYG1HH0DJ2LOAkHvP7+lSTLkKSCYlRjK:0p/4UWcuCAtv8MaAUUjsG1HH0DJ4OPa0
- TLSH T1A5045B5A329C10B2D5A64178CA579A83E3B3B461175097CF0160C7B62F1FBE67A7FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_ctypes.pyd
- Size 139KB
- SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
- MD5 fdda26bd63d43178c9aca5003f6a7e42
- SHA1 48037f1f68aad29e1002573337d2357f8972d045
- SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
- SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
- TLSH T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_lzma.pyd
- Size 157KB
- SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
- MD5 1f2c927c6f1773093e6939e0f0075997
- SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
- SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
- SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
- TLSH T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_socket.pyd
- Size 85KB
- SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
- MD5 893ee6bcfa6b5a527b61eceb80257871
- SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
- SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
- SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
- TLSH T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_wmi.pyd
- Size 39KB
- SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
- MD5 bca71458b37ab9784290593636006405
- SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
- SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
- SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
- TLSH T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\_zstd.pyd
- Size 491KB
- SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
- MD5 256a79eff7505cc58fbf59d863c5c543
- SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
- SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
- SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
- TLSH T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\base_library.zip
- Size 1.3MB
- SHA256 6615b2e7a6f07d0a90350e246db67e662470a29c31a01fe92e64bc0174a19dd9
- MD5 734d8a3cf081ce9efebc7b0819f126c1
- SHA1 d2b7b3b276b63cf9ee2da7c2183d39451670de90
- SHA512 e17c86e859d802645b793b97ab3afe63bbf01b03632fb3acb4e4326e351eba0930fd27ecace4c94788e0563dc63b7b62fdcce98a1e2a635a2e5c5dfbc80dab83
- SSDEEP 24576:xWZlbUdLuUFvbRpOLylQeOdP2m2dfQ3hYZ:VdLuUFzRvl/I3y
- TLSH T1C0552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\cryptography\hazmat\bindings\_rust.pyd
- Size 9.4MB
- SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
- MD5 6a2afa7e9ef97caef783732afbc5a7b3
- SHA1 d1d73a533fdccc03aed6d059f2bf012172b23881
- SHA512 6fde5059726a6ed57b02adadc36c1811c6b5f50976301b62136a386e4f5d5d8c9ac70a6286607c12854eadb2fb06033b2d0af88de0d6c9361e8d3c6bb1e0ff6d
- SSDEEP 98304:rQEAy1nOkNM93c3PYUKMgr56ABAaMvjSL2piQHKEJn+8ingcn2jt:r26ABAaMvjSL2EQH1B7N
- TLSH T105A66C25BAA950ACC86AC4B4C38756339B7134DA0B747AEF49D496B52F36FE01B3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\psutil\_psutil_windows.pyd
- Size 69KB
- SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
- MD5 0a66d22d2ac4f9d41e1605b8d05de77b
- SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
- SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
- SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
- TLSH T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\python3.DLL
- Size 72KB
- SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
- MD5 303f286d14b7db861ad96314bd8bf3f7
- SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
- SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
- SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
- TLSH T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\python314.dll
- Size 6.5MB
- SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
- MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
- SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
- SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
- SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
- TLSH T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI41562\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH