Overview

overview

9

Static

static

3

winlocker_...2).zip

windows10-2004-x64

1

winlocker_...2).zip

windows11-ltsc_2024-x64

1

info_winlock.txt

windows10-2004-x64

1

info_winlock.txt

windows11-ltsc_2024-x64

1

winlock-builder-2.png

windows10-2004-x64

1

winlock-builder-2.png

windows11-ltsc_2024-x64

1

winlock_builder_1.png

windows10-2004-x64

1

winlock_builder_1.png

windows11-ltsc_2024-x64

1

winlocker_....6.exe

windows10-2004-x64

9

winlocker_....6.exe

windows11-ltsc_2024-x64

9

main.pyc

windows10-2004-x64

3

main.pyc

windows11-ltsc_2024-x64

3

winlocker_...TA.exe

windows10-2004-x64

9

winlocker_...TA.exe

windows11-ltsc_2024-x64

9

main1.pyc

windows10-2004-x64

3

main1.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    900s
  • max time network
    902s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    19/07/2026, 12:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winlocker_builder_0.6.exe
  • Size 6.2MB
  • Sample260719-pevjcaax8n
  • SHA256 e6fe8b2f92e4be92ac78d099793cc57d1634762599f18e1ae3def2d56eb40845
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Loads dropped DLL 15 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe
      "C:\Users\Admin\AppData\Local\Temp\winlocker_builder_0.6.exe"
      2⤵
      • Loads dropped DLL
      PID:1384

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_bz2.pyd
        • Size 78KB
        • SHA256 4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_decimal.pyd
        • Size 241KB
        • SHA256 f7864b8b37715a87f4f11d5cbfefd5f1489399e064f7662fa0e0d7c5df59d5e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_hashlib.pyd
        • Size 57KB
        • SHA256 df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_lzma.pyd
        • Size 149KB
        • SHA256 2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_queue.pyd
        • Size 26KB
        • SHA256 9ad5bcf2a88e1ffff3b8ee29235dc92ce48b7fca4655e87cb6e4d71bd1150afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_socket.pyd
        • Size 72KB
        • SHA256 d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ssl.pyd
        • Size 152KB
        • SHA256 ba6025ab22d8e6c5ad53c66dc919f219a542e87540502905609b33dc0a8dddd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\base_library.zip
        • Size 858KB
        • SHA256 3ab0908f3aff84799207a65d93e04d0e1a4013961da383ca25a0f31d74126974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\certifi\cacert.pem
        • Size 280KB
        • SHA256 9102e6a3644a071ba6cdbd4a53698f291c4a64b18450a08bc046548b6db5cc8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\charset_normalizer\md.cp310-win_amd64.pyd
        • Size 10KB
        • SHA256 050db4f1acb328eaed6473dbefce5be4782fc39b5cd96b3371f1eb8ad50e3e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
        • Size 123KB
        • SHA256 3d91cd76d7ba0e99252288b5191c50db5be0d9e2f2bf5fead5dc7bbfff72ba2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\libssl-1_1.dll
        • Size 678KB
        • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\python310.dll
        • Size 4.3MB
        • SHA256 34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd
        • Size 24KB
        • SHA256 b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\unicodedata.pyd
        • Size 1.1MB
        • SHA256 89c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download