Overview

overview

7

Static

static

3

ServerCloner.exe

windows10-2004-x64

7

ServerCloner.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 07:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ServerCloner.exe
  • Size 9.6MB
  • Sample260730-h4renatamd
  • SHA256 5f9814b0b3b573c20d8ca904afd8fa2893200584c180b475558e37accf4548e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 27 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ServerCloner.exe
    "C:\Users\Admin\AppData\Local\Temp\ServerCloner.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5268
    • C:\Users\Admin\AppData\Local\Temp\ServerCloner.exe
      "C:\Users\Admin\AppData\Local\Temp\ServerCloner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5216
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:6704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\VCRUNTIME140.dll
        • Size 120KB
        • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\VCRUNTIME140_1.dll
        • Size 46KB
        • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_asyncio.pyd
        • Size 59KB
        • SHA256 52e472906aade6597b22918df0e9f5eeafb78fcec8c338032d9b2b0f38194a69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_bz2.pyd
        • Size 79KB
        • SHA256 5e60bf60874c660743aa5c7d68e5d6bf9d628a0425156147689ec9992a62427d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_ctypes.pyd
        • Size 127KB
        • SHA256 1c5ae7fc3c9ad94228bbe94f72024d0f01582ced2b9ad5f9dcf3ad505f201917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_hashlib.pyd
        • Size 50KB
        • SHA256 c4bced8d5b633b97ef536696707d6b9476107aa88deb8263d90c8f936813c169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_lzma.pyd
        • Size 152KB
        • SHA256 b9242bf88af07456a29deddabd6ce32310177c4b37042e7d917ef96e9636ef10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_overlapped.pyd
        • Size 43KB
        • SHA256 3d86aa957fe1b07de1d50cb0fdb4303a7fbdee80e24459c27cc94b8ee087a49d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_socket.pyd
        • Size 72KB
        • SHA256 3e4cd9511aa089c75ceabe159cd6cb56d8c667491694a1450ef28235a8a34ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_ssl.pyd
        • Size 169KB
        • SHA256 e20906c0195cc5c4c2df9140b8dfcd28f951eb721d7012c7ab30e647decde9f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_uuid.pyd
        • Size 13KB
        • SHA256 78f380b1472eaf2c8587ae40a18c74f455662ee2516d836e5d393b106bc6eb60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\_wmi.pyd
        • Size 25KB
        • SHA256 b4c8ae409e30d895704f926042ef8910c2656572aa9fc035bb1605a9def45be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\aiohttp\_http_parser.cp313-win_amd64.pyd
        • Size 254KB
        • SHA256 3aa2f531728655a9cf24c431ba1502b873181ee80b4bd30117c62f3e72d49b44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\aiohttp\_http_writer.cp313-win_amd64.pyd
        • Size 42KB
        • SHA256 158f875d222dae4e94ad386670faef6e7ed69d6b0c554db4dd63926761362dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\aiohttp\_websocket\mask.cp313-win_amd64.pyd
        • Size 34KB
        • SHA256 63fda4556a838f283dc007e04d78147147b0753ed859a220d5672d3691031398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        reader_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\aiohttp\_websocket\reader_c.cp313-win_amd64.pyd
        • Size 135KB
        • SHA256 cf170689becd5b770fd5255f99b1dc0d387aa65f11390f12bd963c7fc258d184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\base_library.zip
        • Size 1.3MB
        • SHA256 1fe66741621524320fd74b3b5e118c50d105312c4b3e304de4a928fde7958dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _frozenlist.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\frozenlist\_frozenlist.cp313-win_amd64.pyd
        • Size 67KB
        • SHA256 e55dadf1985e5f755147f352bc5bf3bf6b0fef57c10422e3bfdc4e00061230b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\libcrypto-3.dll
        • Size 6.2MB
        • SHA256 e4fdde97c2af1103fb5d179c030801ff4ea4a1b7a6a785aa1ed95e1763e47de1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\libffi-8.dll
        • Size 47KB
        • SHA256 4dfa3d8fa22b7361babe251b5767e76fc319da86de180accd8721c0874f8b59d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\libssl-3.dll
        • Size 1.5MB
        • SHA256 a4757d546ee0931ac7133eb5c187bbcfedcb31245464bb150800cf88163d3ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\multidict\_multidict.cp313-win_amd64.pyd
        • Size 78KB
        • SHA256 d20eb8153da9ecfd280788f8c6dcfb3e3703c847df22d70d72568c380b63a1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\propcache\_helpers_c.cp313-win_amd64.pyd
        • Size 60KB
        • SHA256 1c3eafe00c2a0e1dd93647a01ebf1874fb2265cb09f58619761f814dc8599f3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\python313.dll
        • Size 6.9MB
        • SHA256 aeae90afd246a75ff9af4e8b971a2286de6320bc32e7022943017a7e483a95e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\select.pyd
        • Size 18KB
        • SHA256 0d348e7f36a532623bf406fc61125794d0a18b5bc907b45c557b6e6eb65c3a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\unicodedata.pyd
        • Size 680KB
        • SHA256 144d87185af06bc3afadf2d426748d2b15f1671366f3837a0202dc5f775620bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52682\yarl\_quoting_c.cp313-win_amd64.pyd
        • Size 80KB
        • SHA256 ca1c319cec6df2ebe8f7364c28bb5930ae60559341f4f90fcb48333e21c9c049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download