Overview

overview

7

Static

static

3

calculator.exe

windows10-2004-x64

7

calculator.exe

windows11-ltsc_2024-x64

7

bootstrap.pyc

windows10-2004-x64

3

bootstrap.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 17:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    calculator.exe
  • Size 46.3MB
  • Sample260720-v76d7sbw41
  • SHA256 e2d9d0ccadcd5742d074eee3255c8c95a13f40598490fd6a52e583c083671bab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 61 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\calculator.exe
    "C:\Users\Admin\AppData\Local\Temp\calculator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Users\Admin\AppData\Local\Temp\calculator.exe
      "C:\Users\Admin\AppData\Local\Temp\calculator.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "calc.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\system32\calc.exe
          calc.exe
          4⤵
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5000
          • C:\Windows\System32\win32calc.exe
            "C:\Windows\System32\win32calc.exe"
            5⤵
              PID:2912

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\PyQt5\Qt5\bin\MSVCP140.dll
          • Size 576KB
          • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\PyQt5\Qt5\bin\MSVCP140_1.dll
          • Size 30KB
          • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\PyQt5\Qt5\bin\Qt5Core.dll
          • Size 5.7MB
          • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
          • Size 43KB
          • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtCore.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\PyQt5\QtCore.pyd
          • Size 2.4MB
          • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sip.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\PyQt5\sip.cp313-win_amd64.pyd
          • Size 117KB
          • SHA256 e63580748533698abdafaff1210f5bb0247b36ee987d0180076eaaa46245c0d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_bz2.pyd
          • Size 84KB
          • SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_cffi_backend.cp313-win_amd64.pyd
          • Size 176KB
          • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_ctypes.pyd
          • Size 130KB
          • SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_hashlib.pyd
          • Size 67KB
          • SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_lzma.pyd
          • Size 155KB
          • SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_queue.pyd
          • Size 34KB
          • SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_socket.pyd
          • Size 84KB
          • SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_ssl.pyd
          • Size 177KB
          • SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\_wmi.pyd
          • Size 38KB
          • SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\base_library.zip
          • Size 1.3MB
          • SHA256 f136ab02bccabfd2a10dd22f732f8238270f5bdec619720cd1bec5b9e2f57c48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _brotlicffi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\brotlicffi\_brotlicffi.pyd
          • Size 838KB
          • SHA256 bdcfb6022d73b22aef357cddae2bde7a03660528c56104edb9beaffe586560c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          orchestrator.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\chardet\pipeline\orchestrator.cp313-win_amd64.pyd
          • Size 10KB
          • SHA256 04eb0880cb0d7f2b5a8d73e75dddb6c7754c8b711f34dabbcd068b8aabe8a983
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\libssl-3.dll
          • Size 776KB
          • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\python3.DLL
          • Size 70KB
          • SHA256 4ae581aa4e65fef9f92c84c428c990892da538b4d9289592df51fa31fd879770
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\python313.dll
          • Size 5.8MB
          • SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythoncom313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\pywin32_system32\pythoncom313.dll
          • Size 674KB
          • SHA256 6187b4a97238f5dced3c6834e7dbae6f58ddccea79d6bbc9d5ca61b12b3c46a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\pywin32_system32\pywintypes313.dll
          • Size 133KB
          • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\select.pyd
          • Size 32KB
          • SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\unicodedata.pyd
          • Size 695KB
          • SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\win32\win32api.pyd
          • Size 135KB
          • SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32event.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\win32\win32event.pyd
          • Size 29KB
          • SHA256 23201e42d29c91e810ce8f697ed0df0bc48a1dc549af006a610b77aaee5a553e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          backend_c.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29602\zstandard\backend_c.cp313-win_amd64.pyd
          • Size 513KB
          • SHA256 e05f3f106d6a907d3402a9543dbd0bef6cc28dbb63377685ebd65af87bfb03d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3620-221-0x00007FFD0FFD0000-0x00007FFD10233000-memory.dmp
          Download

          memory/3620-268-0x00007FFD06130000-0x00007FFD06395000-memory.dmp
          Download