Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 20:33
Behavioral task
behavioral1
Sample
Spammer (1).exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Spammer (1).exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target Spammer (1).exe
- Size 14.1MB
- Sample260720-zb2tcsf13z
- SHA256 5e5afcdbf2b3cc56b9c14465fb205a426650ed9d3941572aa8d04db1095a8591
- MD5 372c40e9605866fc5a3a192f2c409d11
- SHA1 86ada1bbe606d79645780b564d68ceaeeba8b649
- SHA512 0c7ccb42c9019d044b4c167309cc9e5d563ab4509f9ca8f682db4643dddab9623574db3bcdc0c06a5fabc87ed5944796aebbed50a10f3cfec73e5ed22fa49f68
- SSDEEP 393216:nslzCuCjZR6jvKANq6mdUSCJqy14V3w8hR:sFCjZcKAq9qJkE4V3w8hR
- TLSH T169E6331C93F90AFBF4F7953EC651A816D2A97C207F46CACB439083413C636E17A396A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 21 IoCs
pid Process 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe 1244 Spammer (1).exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3296 wrote to memory of 1244 3296 Spammer (1).exe 91
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_bz2.pyd
- Size 84KB
- SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
- MD5 77294e590d14a22d98862c141e7ea4ae
- SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
- SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
- SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
- TLSH T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_ctypes.pyd
- Size 130KB
- SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
- MD5 0ac143334e94105facaddc5fb20fc691
- SHA1 28cf13be0a0eb84f48c919e68f78852aa4856853
- SHA512 00b1a76760b33f054a785be9e4818879121cf5cb60b716d19f2c22c8c58075eea32e626a0962385b18babfaf5d5e33244c09c2e481f99a93577cfeb1647a22e7
- SSDEEP 3072:au1mymWLaxMd/w1KVMSf/Fa4IP0JrsFXI/1cswRIsyPyW4IiFx:ac4WLEMWmRf/FaFP2rsFy0zx
- TLSH T161D37D0B775800AAEAA79178C173AF47EBB1B453171187CF02A4C69A2F637D25E3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_hashlib.pyd
- Size 67KB
- SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
- MD5 7573b8a4d0d7831380d7c12e7fbf0160
- SHA1 769e7bb2af17942ee4ff51f077333ee1cb4c05ab
- SHA512 d730a674cb1585b5adef712acbd2cf212f40824c8c516e958988cbaaae823422cbe5279da180a29a30457cf87a7abac45e24954eb51094a93b5bbf3d2bcff2dc
- SSDEEP 1536:1qXn1xAu1lEAXfXQfcV5TaPutFCAVIsvIByEJ7Q98fIW44DKrd:W1l1uAofcyPutFCAVIsvI4W4Iqd
- TLSH T136637C91AA884092D96382B6C4E34F83F975F352571197CFA2A8C0CE2F237C39776756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_lzma.pyd
- Size 155KB
- SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
- MD5 a0e27c2f376dc80dfc3f884963a0f416
- SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
- SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
- SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
- TLSH T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_queue.pyd
- Size 34KB
- SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
- MD5 922104c7bd756944703d7b93fe61bd99
- SHA1 72e672f312d58b2c241fd08e4493add4b5206ba8
- SHA512 8cb948d05a679292ca3aac6df32add50ca59af14e981aac0e12dbd5ccfe9cd2d303bc2eb093522fc0ea86c761727f56e8c400d9b28bd8f026230c8ad24d2aa56
- SSDEEP 768:Y+Md/6rp7gVh6RIs9UH3ZyEFqU+Y7N2Ip4+oTxf1mltPRVDg+:Sip7gVIRIs9UpyEJ7Q9+UfIZR1v
- TLSH T1C5F26DCAAA684487E963CA70C1E3DE92F535F7D3961186EF2065C2CE1E173C1E369319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_socket.pyd
- Size 84KB
- SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
- MD5 c19dbee6c084ba12b0a7baa8ea3f8b50
- SHA1 9cd0017fbeb1bbc2be40d89006fb73d144a49401
- SHA512 5231af5ba642adcda980187744c448400d58f1179ab98974e9f465f8d7de64375635963d67e52fedd0b0900e0682eb3a9d19c93254a9dff2ff4153b07913a1d0
- SSDEEP 1536:iVl/fxzeola7SVitdyJwoQlyJ+9+nzCK3Y4KxtS4DTDgRIsywQyEJ7Q9vfIU82c2:iVRdeoo7YoyJwoQlyJs+nzCgtKxB8RIs
- TLSH T132835A01A66050FAEBA3D071C2639E63FB74B5C11394A35F1066C65A1F333C2EF7AA95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_ssl.pyd
- Size 177KB
- SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
- MD5 25da0255096a1b094ccba672a6b1d6dd
- SHA1 2904e90fb039f7efa5be3aac3dd6c074647baea9
- SHA512 69601cdfdfe07bd9131922a7a693ef2bcbc3a589dc68c455d12d4bfbffe173d61de3237107624144aa07c230136916c189a9c7de0e6879b30f085219ab1ea2dc
- SSDEEP 3072:4ifuOjwYdI1bnMlfU6CPnzsvyII7IM/cbPuC/JWdIsL7PW4I9Q:4i20wYdknqU6CPwvySgd
- TLSH T1C7047C47B5945AF7E813E4F9C2234903EBB0F145321247DE48D6D64A0F07B4AAE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\_uuid.pyd
- Size 27KB
- SHA256 6748c182df6181cff8691da72dbb81f4f7f446ac7482d5dfe671f2b5333aed5d
- MD5 10229248d3b5c28dc37c56b9d5d7f675
- SHA1 b88fc015591b24a5ebd360177873dff51c862530
- SHA512 f111229fbb6afd420a507493980552ac98edca4bd30844015da4f45be8e0055b3474683f5b79ee122b48173ea3d06bc7a5f08c298b9ea348186462c5ad3ef8b6
- SSDEEP 768:sHVj5ndIs0w5ZyEFqU+Y7N2Ip4xTxf1mlDeI6FKpU6v:sHVj5ndIs0w/yEJ7Q9jfIUF2v
- TLSH T1ADC25CCA9A648043FE939BB0D1F2DE43B939BBD35611869B3165C2D60E533C1E31A369
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\base_library.zip
- Size 1.3MB
- SHA256 71dd2f4e8cf9ef5e0cbebd40230bc9dbe171551fa2632c9828ac8dce3fd5fdba
- MD5 792ea8c7a6745851abae2f87f0d88b2d
- SHA1 77066f4e759dd57429b1d0f7be64691355b1cf2a
- SHA512 b5d46554cafca244831b367e1252937d1007315e49617285ba9e3620f9a0851bd15242f3cf93a771596519d33a9d02c5266c0030ba1b3b212071f320512dc942
- SSDEEP 12288:c2HyCMWfTR8aiqi2cPPdxhYe6UwtLdjdT3L+D5uIva80201jwCVRDVoioSYBSIq+:c45cPPdxhYiSdZMlbqt7WpgSeT1GF9
- TLSH T185550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\charset_normalizer\md.cp313-win_amd64.pyd
- Size 10KB
- SHA256 4e66da1baef3b663ab8f48feed4ed1d72e977b4209240595d2c440071bc632c8
- MD5 9d06b4fe0c2b5b3b386a99ef80f0e968
- SHA1 76b9db0ee7332db4b0011c85edbd03dd805eeeb0
- SHA512 9e4efd89536641531037427e04e800bf3c71dc277e07861460a963f62a519ee181c89d7f89297d17179d24487519f3b6f280c452cebf71b55d5ef048dbeab347
- SSDEEP 192:6xGrmoX+sMl/++Ch9p8VBdisuOL58A0JH6:6x4m446mDZuI8Ae
- TLSH T1F622F75CFA6458EAE9168134C9374E4AB132BB2217027BCF8370D16E2FA37E66534785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- Size 125KB
- SHA256 a26b6459a25f1e9b600ac3df6b2c4f30d7f9d643292546b85ccb763d49fdea90
- MD5 0fadfd9e08e576839fa4875cad8727d6
- SHA1 e3df4fed3cfaa8554068b1ecda97aa4aa7b421d5
- SHA512 946934dd023b612974be3335fd323e0657ef4125338fc0257bf877691c08f98f19c2bcdbadae9a90b2c4b56abe74cc7ee76998b9f164e70596848330e11c6cfa
- SSDEEP 3072:gd2ptVk3J/37NxXtng+ByrhuJud3YYAbpYk8:ZpiO+BzJazAbek8
- TLSH T12EC32A1762950073DA634278CCB76916DBE1B951173253CF04E4C75A2F07BEABEBEA02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\lxml\_elementpath.cp313-win_amd64.pyd
- Size 144KB
- SHA256 1cc38e702eb69aac7fcc8a5bfac5d25eb64fb2352ebb795aded5add3269d3736
- MD5 9c23dfc7fd286c67dffc445089e3945d
- SHA1 60340c48d1280be6588e4aceaf2657b7bf62b8c9
- SHA512 c2db3f66bb62a31d5d709aef0f3eccad0f10eee125bca9fcd5946b6f10f182cc0a99bfa58d6efe6c3c52e2e90068793dc99eb7ebecd5513f5dffafae7cbfa21b
- SSDEEP 1536:DYRgZb8beTAkEhdntqoaVHVq+/5O9tlLwDcw9cb0oKF:kW8qTNETntC1VqiWM/9cb0
- TLSH T1D3E32927B2E40057DA93A1B588337927FBB270512B113BCF0150D75A2F63BDABABD251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\lxml\etree.cp313-win_amd64.pyd
- Size 3.9MB
- SHA256 547aacfa7c23afa48ed5a6e42b8e0f719086fe0130a35d51ffc60b2738a98fe4
- MD5 9151941157cf01ee6f1fc34e431e1b03
- SHA1 8bbaba1d44b658ccbf9855bd98c002dceb4f1a2b
- SHA512 47ea86d0eba80198e57512776d8174906d91a3b5e6a68c14850cfc1366135ebcfca76b59af8a02456ec4a5434127507344e9583024e0cf926749883b5deafeb4
- SSDEEP 49152:9O62dwivJRT2FYdWkhF2O5WyB5Y9Rmz7kLjezT/cMzUYMCYr+32t9uohbBAUZLYg:9ORw0mpWdX3YS+bBAUZLz
- TLSH T1A9168D03E2E5006ADA57D17589276723EBF1BC152B212ACB6064F2592F73FE213FE605
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\python313.dll
- Size 5.8MB
- SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
- MD5 cfbfd5ca1d563466687e53a638eed93c
- SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
- SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
- SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
- TLSH T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\select.pyd
- Size 32KB
- SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
- MD5 7a066f58d43c0f3546944d046959ab0d
- SHA1 03f2b88e97add974eff48a21454a3e609f943e57
- SHA512 199d9f0a2fe47a0b7d25a5c2d6ee74e9507c67c166059985ade8292f4a2741824e91b934e391acad4da8ee187d94b007438a57b63496e91ab2ec7a5da14a0b8c
- SSDEEP 768:EpX5KHfOmHzPRIs9GnZyEFqU+Y7N2Ip434bTxf1ml/6dHQzZ:AX5K/OmHzPRIs9GZyEJ7Q9IZfIgHU
- TLSH T110E27DCA6E785043EAA3CA71C5E2DE43F939B3E35611819F30A5C19A1E177C1E33A358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32962\unicodedata.pyd
- Size 695KB
- SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
- MD5 cb468cb183404de9c2ba3c9b4489b348
- SHA1 7ef19c9b9cf63dc225b0d1d337e4c1ab45bfb9e2
- SHA512 ebe8defac7ae435c33b66fc4f7d288a00a95685b47aee7520309758f261d2d103a6cafc8b23da441350ffbf168224932430124042ffd614ad4bc05bd379a7cb2
- SSDEEP 12288:rYvdLI/X77mvfldCKGihH32W3cnPSqrUgYMMe:rYvW7qNxr3cnPXYBe
- TLSH T137E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH