Overview

overview

7

Static

static

3

PaintPilot...n].exe

windows10-2004-x64

7

PaintPilot...n].exe

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 02:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PaintPilot [Meccha Chameleon].exe
  • Size 11.0MB
  • Sample260730-crvcws1te1
  • SHA256 155529665c70c44f2b9f28d3b9328295a7af7b42a13e16ce71449863c0ee251c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PaintPilot [Meccha Chameleon].exe
    "C:\Users\Admin\AppData\Local\Temp\PaintPilot [Meccha Chameleon].exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c update.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Users\Admin\AppData\Local\Temp\PaintPilot.exe
        PaintPilot.exe
        3⤵
        • Executes dropped EXE
        PID:4732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        • Size 808B
        • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1B1495DD322A24490E2BF2FAABAE1C61
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
        • Size 355B
        • SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9743D2F30194FEF5E6DAB7ACCCB46DDA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9743D2F30194FEF5E6DAB7ACCCB46DDA
        • Size 34KB
        • SHA256 97d78abb91aebe1761a95b02fdd23b5d4cbe4d5b9206f1a65f5820c166d62983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        • Size 192B
        • SHA256 d77b221b8079219fad03c431f543b92a5ddd86353e7e4c2ae7173f49ac92bda4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1B1495DD322A24490E2BF2FAABAE1C61
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
        • Size 192B
        • SHA256 611b15c4d574a6e0f7db0320d568786c3288ee019631a4aaac83966cdaa358b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9743D2F30194FEF5E6DAB7ACCCB46DDA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9743D2F30194FEF5E6DAB7ACCCB46DDA
        • Size 246B
        • SHA256 3696b608d799cb1015dac337df33a540b5803c05344ab43b7beb2119d9b573ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PaintPilot_new.exe
        • Path C:\Users\Admin\AppData\Local\Temp\PaintPilot_new.exe
        • Size 11.3MB
        • SHA256 6034c1c21e011b24b975ab700b691a636b19265878bcd55068f13c4005ac2726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        update.bat
        • Path C:\Users\Admin\AppData\Local\Temp\update.bat
        • Size 191B
        • SHA256 8bce2885326d41c54da16adfef9c3b63a37e8c2f3930bb894b3af42f23b3fbf1
        • MD5 SHA1 SHA512 TLSH
        Submit Download