Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/07/2026, 02:10
General
- Target e577e5c57cc385a194b9933cee925c26a96d84e94e3f68734f59cd2b36eeab95.exe
- Size 14.0MB
- Sample260724-cl33va1ejd
- SHA256 e577e5c57cc385a194b9933cee925c26a96d84e94e3f68734f59cd2b36eeab95
Malware Config
Signatures
- Loads dropped DLL 46 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e577e5c57cc385a194b9933cee925c26a96d84e94e3f68734f59cd2b36eeab95.exe"C:\Users\Admin\AppData\Local\Temp\e577e5c57cc385a194b9933cee925c26a96d84e94e3f68734f59cd2b36eeab95.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e577e5c57cc385a194b9933cee925c26a96d84e94e3f68734f59cd2b36eeab95.exe"C:\Users\Admin\AppData\Local\Temp\e577e5c57cc385a194b9933cee925c26a96d84e94e3f68734f59cd2b36eeab95.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ecb.pyd
_raw_ofb.pyd
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp310-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
_speedups.cp310-win_amd64.pyd
pyexpat.pyd
python310.dll
pythoncom310.dll
pywintypes310.dll
select.pyd
_speedups.cp310-win_amd64.pyd
tinyaes.cp310-win_amd64.pyd
ucrtbase.dll
unicodedata.pyd
win32api.pyd
memory/2260-237-0x00007FF8042A0000-0x00007FF8042AB000-memory.dmp
memory/2260-244-0x00007FF804230000-0x00007FF80423E000-memory.dmp
memory/2260-194-0x00007FF808BE0000-0x00007FF808BF9000-memory.dmp
memory/2260-181-0x00007FF804690000-0x00007FF8046BC000-memory.dmp
memory/2260-182-0x00007FF804560000-0x00007FF80458F000-memory.dmp
memory/2260-183-0x00007FF808AE0000-0x00007FF808B04000-memory.dmp
memory/2260-185-0x00007FFFF8610000-0x00007FFFF86D1000-memory.dmp
memory/2260-220-0x00007FF804390000-0x00007FF80439C000-memory.dmp
memory/2260-219-0x00007FF803E70000-0x00007FF803E80000-memory.dmp
memory/2260-218-0x00007FF803E80000-0x00007FF803E95000-memory.dmp
memory/2260-217-0x00007FF803EA0000-0x00007FF803EAA000-memory.dmp
memory/2260-216-0x00007FF803B40000-0x00007FF803B82000-memory.dmp
memory/2260-215-0x00007FFFF6F30000-0x00007FFFF7048000-memory.dmp
memory/2260-214-0x00007FF804210000-0x00007FF804224000-memory.dmp
memory/2260-213-0x0000021831420000-0x0000021831795000-memory.dmp
memory/2260-174-0x00007FF8049F0000-0x00007FF8049FD000-memory.dmp
memory/2260-171-0x00007FF804810000-0x00007FF804844000-memory.dmp
memory/2260-168-0x00007FF804850000-0x00007FF80487D000-memory.dmp
memory/2260-195-0x00007FFFF7990000-0x00007FFFF7A48000-memory.dmp
memory/2260-166-0x00007FF805260000-0x00007FF805279000-memory.dmp
memory/2260-191-0x00007FF804530000-0x00007FF80455E000-memory.dmp
memory/2260-190-0x00007FF8098F0000-0x00007FF8098FF000-memory.dmp
memory/2260-162-0x00007FF8098E0000-0x00007FF8098ED000-memory.dmp
memory/2260-224-0x00007FF808CD0000-0x00007FF808CE3000-memory.dmp
memory/2260-223-0x00007FF804850000-0x00007FF80487D000-memory.dmp
memory/2260-159-0x00007FF808BE0000-0x00007FF808BF9000-memory.dmp
memory/2260-228-0x00007FF8042B0000-0x00007FF8042E8000-memory.dmp
memory/2260-227-0x00007FF804810000-0x00007FF804844000-memory.dmp
memory/2260-151-0x00007FF809A50000-0x00007FF809A60000-memory.dmp
memory/2260-155-0x00007FF808AE0000-0x00007FF808B04000-memory.dmp
memory/2260-239-0x00007FF804290000-0x00007FF80429C000-memory.dmp
memory/2260-156-0x00007FF8098F0000-0x00007FF8098FF000-memory.dmp
memory/2260-198-0x00007FFFF7610000-0x00007FFFF7985000-memory.dmp
memory/2260-180-0x00007FFFF7C40000-0x00007FFFF80AF000-memory.dmp
memory/2260-232-0x00007FF8049F0000-0x00007FF8049FD000-memory.dmp
memory/2260-243-0x00007FF804240000-0x00007FF80424D000-memory.dmp
memory/2260-241-0x00007FF804260000-0x00007FF80426B000-memory.dmp
memory/2260-146-0x00007FFFF7C40000-0x00007FFFF80AF000-memory.dmp
memory/2260-246-0x00007FF804280000-0x00007FF80428B000-memory.dmp
memory/2260-245-0x00007FFFF8610000-0x00007FFFF86D1000-memory.dmp
memory/2260-234-0x00007FF804590000-0x00007FF80459B000-memory.dmp
memory/2260-242-0x00007FF804250000-0x00007FF80425C000-memory.dmp
memory/2260-256-0x00007FFFF7990000-0x00007FFFF7A48000-memory.dmp
memory/2260-260-0x00007FFFF87F0000-0x00007FFFF8802000-memory.dmp
memory/2260-259-0x00007FFFF8810000-0x00007FFFF881D000-memory.dmp
memory/2260-258-0x00007FF803B40000-0x00007FF803B82000-memory.dmp
memory/2260-257-0x00007FFFF7610000-0x00007FFFF7985000-memory.dmp
memory/2260-255-0x00007FFFFDED0000-0x00007FFFFDEDC000-memory.dmp
memory/2260-254-0x00007FF800A10000-0x00007FF800A1C000-memory.dmp
memory/2260-253-0x00007FF803B20000-0x00007FF803B2C000-memory.dmp
memory/2260-252-0x00007FF804530000-0x00007FF80455E000-memory.dmp
memory/2260-251-0x00007FF803B30000-0x00007FF803B3C000-memory.dmp
memory/2260-250-0x00007FF803AC0000-0x00007FF803ACB000-memory.dmp
memory/2260-249-0x00007FF803AD0000-0x00007FF803ADB000-memory.dmp
memory/2260-248-0x0000021831420000-0x0000021831795000-memory.dmp
memory/2260-247-0x00007FF804270000-0x00007FF80427C000-memory.dmp
memory/2260-261-0x00007FFFF87E0000-0x00007FFFF87EC000-memory.dmp
memory/2260-262-0x00007FF8042B0000-0x00007FF8042E8000-memory.dmp
memory/2260-265-0x00007FF808AE0000-0x00007FF808B04000-memory.dmp
memory/2260-282-0x00007FF803B40000-0x00007FF803B82000-memory.dmp
memory/2260-267-0x00007FF808BE0000-0x00007FF808BF9000-memory.dmp
memory/2260-263-0x00007FFFF7C40000-0x00007FFFF80AF000-memory.dmp
memory/2260-315-0x00007FFFF7C40000-0x00007FFFF80AF000-memory.dmp
memory/2260-330-0x00007FFFF7610000-0x00007FFFF7985000-memory.dmp
memory/2260-329-0x00007FFFF7990000-0x00007FFFF7A48000-memory.dmp
memory/2260-328-0x00007FF804530000-0x00007FF80455E000-memory.dmp