Overview

overview

7

Static

static

3

9c476374bb...2b.exe

windows10-2004-x64

7

9c476374bb...2b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 23:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
  • Size 13.8MB
  • Sample260719-3qd8dsbs8t
  • SHA256 9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
    "C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
      "C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      PID:5764
  • C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
    C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
      C:\Users\Admin\AppData\Local\Temp\9c476374bb0d6fd0d38b7258a38b449fa6e6d38e119f4a1ad1a55a0b88c1452b.exe
      2⤵
      • Loads dropped DLL
      PID:1972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_brotli.cp313-win_amd64.pyd
        • Size 804KB
        • SHA256 67dfa82dcaed04ed3f358d84b18d1375d59126161de92e00164d36087b179d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_bz2.pyd
        • Size 82KB
        • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_ctypes.pyd
        • Size 128KB
        • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_hashlib.pyd
        • Size 62KB
        • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_lzma.pyd
        • Size 154KB
        • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_queue.pyd
        • Size 32KB
        • SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_socket.pyd
        • Size 81KB
        • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_ssl.pyd
        • Size 177KB
        • SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_uuid.pyd
        • Size 25KB
        • SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\_wmi.pyd
        • Size 37KB
        • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\base_library.zip
        • Size 1.3MB
        • SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bcj.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\bcj\_bcj.cp313-win_amd64.pyd
        • Size 23KB
        • SHA256 24e60eafe497f8a803ea6b64ded065d93e640a496eab8eccef20e5331bebf886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\certifi\cacert.pem
        • Size 292KB
        • SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 002697227449b6d69026d149cfb220ac85d83b13056c8aa6b9dac3fd3b76caa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
        • Size 122KB
        • SHA256 c393098e7803abf08ee8f7381ad7b0f8faffbf66319c05d72823308e898f8cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _inflate64.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\inflate64\_inflate64.cp313-win_amd64.pyd
        • Size 42KB
        • SHA256 4f1b44e7113776b234797fa50cf8163db4a1d41d9832ef661cd2d7d3d5abc3cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyarmor_runtime.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\pyarmor_runtime_000000\pyarmor_runtime.pyd
        • Size 624KB
        • SHA256 537346e9d4a5b424dd5a1418ee41cb909c4aa5e721cd44241b3695407e097844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\pyexpat.pyd
        • Size 196KB
        • SHA256 d3e81017b4a82ae1b85e8cd6b9b7eb04d8817e29e5bc9ece549ac24c8bb2ff23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ppmd.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\pyppmd\c\_ppmd.cp313-win_amd64.pyd
        • Size 56KB
        • SHA256 a24f44aff5608a23a5c1d0a587a559d8024334b39f14a11cf48ca019ed80ef9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\python3.DLL
        • Size 68KB
        • SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\python313.dll
        • Size 5.8MB
        • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\pywin32_system32\pywintypes313.dll
        • Size 132KB
        • SHA256 d011068781cfba0955258505dbe7e5c7d3d0b955e7f7640d2f1019d425278087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\pyzstd\c\_zstd.cp313-win_amd64.pyd
        • Size 585KB
        • SHA256 3e485fda78e2830d03bee752894334d1b5684f8ce9f313c3306fcf211db0dc06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\select.pyd
        • Size 30KB
        • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\unicodedata.pyd
        • Size 693KB
        • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\win32\win32api.pyd
        • Size 130KB
        • SHA256 e19294bc2c145a9d87d4a2d8412830c8ff4c8c1b9ad005bd68abd4b566af1887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50682\win32\win32event.pyd
        • Size 28KB
        • SHA256 2362b5814e439fde7fca93416562a3e453b90fb13d8b9a8cf3763bda9650d6bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1972-272-0x0000000070180000-0x000000007022A000-memory.dmp
        Download

        memory/5764-167-0x0000000070180000-0x000000007022A000-memory.dmp
        Download