c70981b03be66faa21cce7c880810e31ef492ff404a57c28bb8b4890a0819d26

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
Size 32.3MB
Sample260724-3xd6zawcmd
SHA256 c70981b03be66faa21cce7c880810e31ef492ff404a57c28bb8b4890a0819d26
MD5 a8025f563b97901d8ad6f679dd505267
SHA1 ecbacd1076d44f51bb4e21138626e3c4ed23d859
SHA512 a41a3916f7d0136cd99cd4f61e514bd53359876ca0dc3f731e1e9425d87dc033a6f7020ae2977a38266b6edaf17050862eb0f77bde833081f00b02240741370a
SSDEEP 786432:52G4TLcNOCMG58KPwrvUC+nT5T5mtZq5ttRwELSPp9:STIACPdorvOThUDq5tvwELSv
TLSH
T11C773380738419C8E4471339E6D9CF7747A2B6727F21CE1F27F342A18DA32C558A9799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 19 IoCs

pid	Process
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
4120	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3424	cmd.exe
596	cmd.exe
5244	cmd.exe
5940	cmd.exe
1216	cmd.exe
5060	cmd.exe
1860	cmd.exe
4968	cmd.exe
6140	cmd.exe
4440	cmd.exe
4648	cmd.exe
5280	cmd.exe
4500	cmd.exe
5240	cmd.exe
2928	cmd.exe
5232	cmd.exe
4584	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2156	taskkill.exe
1712	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 4120	2124	2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe	90
PID 3424 wrote to memory of 2156	3424	cmd.exe	97
PID 5240 wrote to memory of 5244	5240	cmd.exe	98
PID 4968 wrote to memory of 4440	4968	cmd.exe	99
PID 5940 wrote to memory of 1216	5940	cmd.exe	100
PID 596 wrote to memory of 5060	596	cmd.exe	101
PID 6140 wrote to memory of 4648	6140	cmd.exe	102
PID 4440 wrote to memory of 5232	4440	cmd.exe	103
PID 1216 wrote to memory of 1860	1216	cmd.exe	104
PID 5244 wrote to memory of 2928	5244	cmd.exe	105
PID 4648 wrote to memory of 5280	4648	cmd.exe	109
PID 5060 wrote to memory of 4584	5060	cmd.exe	110
PID 4500 wrote to memory of 1712	4500	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-24_a8025f563b97901d8ad6f679dd505267_blankgrabber_glassworm_icedid_luca-stealer_njrat_petya.exe"
  2⤵
  - Loads dropped DLL
  PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES...""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:596
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\system32\cmd.exe
        
        cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
        5⤵
        Executes a command shell one-liner
        
        PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES...""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Windows\system32\cmd.exe
        
        cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
        5⤵
        Executes a command shell one-liner
        
        PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES...""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5240
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\Windows\system32\cmd.exe
        
        cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
        5⤵
        Executes a command shell one-liner
        
        PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES...""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Windows\system32\cmd.exe
        
        cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
        5⤵
        Executes a command shell one-liner
        
        PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES...""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\system32\cmd.exe
        
        cmd /k "echo WARNING: SYSTEM INTEGRITY COMPROMISED! && echo ENCRYPTING FILES..."
        5⤵
        Executes a command shell one-liner
        
        PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im cmd.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cmd.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\PIL\_imaging.cp314-win_amd64.pyd
Size 2.5MB
SHA256 b4e06283c347910b5973bd5732159ea9eb26eda48e3eed183be2e3382db26597
MD5 78734fe23107c306715a4883e9ff75bd
SHA1 a03120f72e53eaee2cdd784a1e28eefee3d54ea6
SHA512 31564284c9875af9edbccfe27c8a3a077224788805531b3e975f0a5886bbc1bda15b2d8e0bf5088574f2daa6cf04969f09c24cd191944e59ad21b4c9898f387d
SSDEEP 49152:sUDqalNynk/D54BnHYq+1p0HFavJnRpXYnWpXM:aIrq5Fav9oE8
TLSH
T1CCC56C06E9D19599C6B28034CDAAC116E3B1B80D17F187F77684A7F93E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_tkinter.pyd
Size 67KB
SHA256 14f0b750f800ed529a06052369428f75f204005be1633400c9fe0ca544d82f85
MD5 8f88a89243cd2cd254a31c2001accb3e
SHA1 bf73246b339970ccc9162719c3dc9c24746a8bd8
SHA512 dfb2230504bec8717cffb08ee4029c144addda6a87adaf2948fe1d7dc10e08a2b581489dccff60c26854e5728ed687df231bbfa42a78a3ac312b3a89601c12ca
SSDEEP 1536:MoTKqNDDa/Tf3gOrlU9oo6ptbQIjDStcyYiS95fIbH0ns2L:MoOjllPo6ptbQIjDStFTQ
TLSH
T1C0637D9AA764008ADE67D578C5B79F13E679F9520910534F00A4D38E1F333F2ABBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
MD5 6a2afa7e9ef97caef783732afbc5a7b3
SHA1 d1d73a533fdccc03aed6d059f2bf012172b23881
SHA512 6fde5059726a6ed57b02adadc36c1811c6b5f50976301b62136a386e4f5d5d8c9ac70a6286607c12854eadb2fb06033b2d0af88de0d6c9361e8d3c6bb1e0ff6d
SSDEEP 98304:rQEAy1nOkNM93c3PYUKMgr56ABAaMvjSL2piQHKEJn+8ingcn2jt:r26ABAaMvjSL2EQH1B7N
TLSH
T105A66C25BAA950ACC86AC4B4C38756339B7134DA0B747AEF49D496B52F36FE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\python3.dll
Size 72KB
SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
MD5 303f286d14b7db861ad96314bd8bf3f7
SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
TLSH
T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\tcl86t.dll
Size 1.8MB
SHA256 77c41c2d5850224b21d1f35d29cff87ac4d5d847e3694c52f5f63f5eaac7d1f2
MD5 b99a3b97e090cf78a5063ad64af0411a
SHA1 62bbd39f6305497b98fae0795c1d35d908483c14
SHA512 889986f553d934d0b99ffa18d74f8ca9e035a3018a58ea409065ef584008f3ec879f09ebc4d0a7bdc4a69ffef4cc7250296cd2b6a2ed4c18f60f55dbd2d2f2b2
SSDEEP 49152:C0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGB:LBUqMR7i6x9T+B
TLSH
T1E7859E1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\tk86t.dll
Size 1.5MB
SHA256 c85f46920f82c05ac7eb6ea27dcf85d716377edaede778bcd2c40d991e341f22
MD5 c3c9096242b05677a0d1064badcb8c7b
SHA1 31b602aa7f9508d7ffc928814929bce5e263b86a
SHA512 152a49dae30eff7827bd3ed7016f9b021350c05462ead8c3846b8bc6834ff1586c53d2a004c6268eff1523f18acfbd82e85f89fd8b3259c0663041059967171c
SSDEEP 49152:076DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezfzt:ZQchLNqaJvARxr9DrTwylL1y5BEq8JT+
TLSH
T1AF754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\zlib1.dll
Size 144KB
SHA256 4f4168a375d3628f96846f5a9319f55521a501e30d9b7e91c384e64fb3245d4c
MD5 71700382fc3394b7adf0e570b19d1a2d
SHA1 ecee1af12c57270269949e6fed4b33551ac1a2c4
SHA512 c10a6ddf4869d5de91c22a8c824801d3dcebbbbfd534b9752e29bb0c4f15a64185801f87861ca78fe58125da0b6e99598cb37b6438f09df45b3babbda7e8f23f
SSDEEP 3072:EvEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCGJa:EsVD+RrFgvi7JM
TLSH
T12CE37D9BB6A255BDC677817042E6C7B2F932B8214B309DEF5088D7741A12F806B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-1076-0x00007FFBBE640000-0x00007FFBBE669000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads