Overview

overview

7

Static

static

3

Scythe.exe

windows10-2004-x64

7

Scythe.exe

windows11-ltsc_2024-x64

7

Resubmissions

18/07/2026, 08:32

260718-ke9aaadz4p7

18/07/2026, 08:29

260718-kd2ttag17v7

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    118s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 08:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Scythe.exe
  • Size 57.4MB
  • Sample260718-kd2ttag17v
  • SHA256 805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 37 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scythe.exe
    "C:\Users\Admin\AppData\Local\Temp\Scythe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\Scythe.exe
      "C:\Users\Admin\AppData\Local\Temp\Scythe.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c
        3⤵
        • Executes a command shell one-liner
        PID:2788
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c mode con: cols=200 lines=30
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\system32\mode.com
          mode con: cols=200 lines=30
          4⤵
            PID:6064

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\MSVCP140.dll
          • Size 576KB
          • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _imaging.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\PIL\_imaging.cp39-win_amd64.pyd
          • Size 3.1MB
          • SHA256 439e81562020d337965bb6f5d71ac7efbf43cac6fef67b092c17d52a798bf2f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _imagingft.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\PIL\_imagingft.cp39-win_amd64.pyd
          • Size 1.3MB
          • SHA256 fab873b798c37cfeeb87d3ba2fb6b26946ad5feacb3c240d060fec6bd4eac4fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\VCRUNTIME140.dll
          • Size 94KB
          • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_asyncio.pyd
          • Size 63KB
          • SHA256 3ad5f4bd4361df0c077122a91d180dcf9b68b0249fc6b39edda5dd4ece6f23f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_bz2.pyd
          • Size 84KB
          • SHA256 9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_ctypes.pyd
          • Size 123KB
          • SHA256 1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_hashlib.pyd
          • Size 64KB
          • SHA256 7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_lzma.pyd
          • Size 159KB
          • SHA256 4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_overlapped.pyd
          • Size 45KB
          • SHA256 fd9e9467e1353f9dc02143481085f2440f25286d0a4630aa8b1d8919cbb50b8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_queue.pyd
          • Size 28KB
          • SHA256 b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_socket.pyd
          • Size 78KB
          • SHA256 241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_ssl.pyd
          • Size 151KB
          • SHA256 31c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\_tkinter.pyd
          • Size 64KB
          • SHA256 cea57bb0f8c71c526e8bf799c3b53264b2405ed954122498f92e29735dde2901
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _helpers.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\aiohttp\_helpers.cp39-win_amd64.pyd
          • Size 47KB
          • SHA256 399dfeee9a2f8c6a132c2d4d28931f4c6c0f1d1394de54b182a6457d9143a418
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\base_library.zip
          • Size 764KB
          • SHA256 ab34fb921a79e9b635d5dd17f3c1b24456d07e4165defdb3c1d047eff0efdb48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\libssl-1_1.dll
          • Size 678KB
          • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\multidict\_multidict.cp39-win_amd64.pyd
          • Size 45KB
          • SHA256 edfae77b7d0c2efd7c274593c4a9d3a149ad842f697e591a907c586f37b61bc0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\pyexpat.pyd
          • Size 199KB
          • SHA256 ab0814b19fd6b10d2729a907cf449f8a858a42b3f1288fb1c93b62950059295d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\python3.dll
          • Size 58KB
          • SHA256 84cb29052734ec4ad5d0eac8a9156202a2077ee9bd43cabc68e44ee22a74910a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\python39.dll
          • Size 4.3MB
          • SHA256 e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythoncom39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\pythoncom39.dll
          • Size 543KB
          • SHA256 9b3d25eb5b8cd86dac4b6301df30c2a9b9815732e52b6d8e96bf58a6ad988a84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\pywintypes39.dll
          • Size 139KB
          • SHA256 4dcdc4f5e684d0c031122515b4f089e33dc0cc9869ef1ab65832ac90cf428906
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\select.pyd
          • Size 28KB
          • SHA256 5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\tcl86t.dll
          • Size 1.6MB
          • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\tcl\encoding\cp1252.enc
          • Size 1KB
          • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\tk86t.dll
          • Size 1.4MB
          • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\win32api.pyd
          • Size 131KB
          • SHA256 2ab33cca6227c6a2d5d9cc5e694a678a292b3b26e299cb94343a466900d7014c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI39962\yarl\_quoting_c.cp39-win_amd64.pyd
          • Size 78KB
          • SHA256 dd9c821da6f5c8701a1d0486c8d22943189b7642ee5d27fa76b4fc74d6462876
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download