Overview

overview

9

Static

static

3

winlocker_...2).zip

windows10-2004-x64

1

winlocker_...2).zip

windows11-ltsc_2024-x64

1

info_winlock.txt

windows10-2004-x64

1

info_winlock.txt

windows11-ltsc_2024-x64

1

winlock-builder-2.png

windows10-2004-x64

1

winlock-builder-2.png

windows11-ltsc_2024-x64

1

winlock_builder_1.png

windows10-2004-x64

1

winlock_builder_1.png

windows11-ltsc_2024-x64

1

winlocker_....6.exe

windows10-2004-x64

9

winlocker_....6.exe

windows11-ltsc_2024-x64

9

main.pyc

windows10-2004-x64

3

main.pyc

windows11-ltsc_2024-x64

3

winlocker_...TA.exe

windows10-2004-x64

9

winlocker_...TA.exe

windows11-ltsc_2024-x64

9

main1.pyc

windows10-2004-x64

3

main1.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    387s
  • max time network
    904s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-de
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 12:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winlocker_builder_0.6.exe
  • Size 6.2MB
  • Sample260719-pevjcaax8n
  • SHA256 e6fe8b2f92e4be92ac78d099793cc57d1634762599f18e1ae3def2d56eb40845
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Loads dropped DLL 15 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe
      "C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe"
      2⤵
      • Loads dropped DLL
      PID:5688
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:8984
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:9500

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_bz2.pyd
            • Size 78KB
            • SHA256 4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_decimal.pyd
            • Size 241KB
            • SHA256 f7864b8b37715a87f4f11d5cbfefd5f1489399e064f7662fa0e0d7c5df59d5e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_hashlib.pyd
            • Size 57KB
            • SHA256 df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_lzma.pyd
            • Size 149KB
            • SHA256 2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_queue.pyd
            • Size 26KB
            • SHA256 9ad5bcf2a88e1ffff3b8ee29235dc92ce48b7fca4655e87cb6e4d71bd1150afb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_socket.pyd
            • Size 72KB
            • SHA256 d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\_ssl.pyd
            • Size 152KB
            • SHA256 ba6025ab22d8e6c5ad53c66dc919f219a542e87540502905609b33dc0a8dddd8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\base_library.zip
            • Size 858KB
            • SHA256 3ab0908f3aff84799207a65d93e04d0e1a4013961da383ca25a0f31d74126974
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cacert.pem
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\certifi\cacert.pem
            • Size 280KB
            • SHA256 9102e6a3644a071ba6cdbd4a53698f291c4a64b18450a08bc046548b6db5cc8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            md.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\charset_normalizer\md.cp310-win_amd64.pyd
            • Size 10KB
            • SHA256 050db4f1acb328eaed6473dbefce5be4782fc39b5cd96b3371f1eb8ad50e3e7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            md__mypyc.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
            • Size 123KB
            • SHA256 3d91cd76d7ba0e99252288b5191c50db5be0d9e2f2bf5fead5dc7bbfff72ba2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\python310.dll
            • Size 4.3MB
            • SHA256 34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\select.pyd
            • Size 24KB
            • SHA256 b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39402\unicodedata.pyd
            • Size 1.1MB
            • SHA256 89c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download