Analysis
- max time kernel
150s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 13:07
Behavioral task
behavioral1
Sample
trojan.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
trojan.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target trojan.exe
- Size 71.4MB
- Sample260730-qcy97asvcs
- SHA256 e363990d6a236c0d611569d13220d671a270935f36b8ac003649c31aeaf1ece5
- MD5 ff31fac94acc5dc7932e365dffbe2866
- SHA1 034d214f9068c50e964511f01a8b462cc05b63a8
- SHA512 25c715dbfd7d1a8456cf2a1821cfd78b5a9798c10c59a5ffa269e8bffd63f71f3fa72d7807321d97f6f29f1a1e3b01bccab2440298db4fbefb99c9e739066650
- SSDEEP 1572864:n4f/5pOYEUZl7XNyjhQR5QMJJ8R/E0/utd0xyerNOThxHGDq5tovviw:4fRpFEQlLgaR55oR/E0/kd0xhQFxHGey
- TLSH T16BF733C0BE8939ABD8A12630B5D96D27D3C6305D9B63C95F1BD0A2362F633409D71BB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nemesis_worm.exe trojan.exe - Loads dropped DLL 40 IoCs
pid Process 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 5112 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe 1664 trojan.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\NemesisUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trojan.exe" trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\NemesisUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trojan.exe" trojan.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\Tasks\nemesis_worm.exe trojan.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 552 wrote to memory of 5112 552 trojan.exe 89 PID 5444 wrote to memory of 1664 5444 trojan.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\trojan.exe"C:\Users\Admin\AppData\Local\Temp\trojan.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\trojan.exe"C:\Users\Admin\AppData\Local\Temp\trojan.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\trojan.exeC:\Users\Admin\AppData\Local\Temp\trojan.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\trojan.exeC:\Users\Admin\AppData\Local\Temp\trojan.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
PID:1664
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_bz2.pyd
- Size 86KB
- SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
- MD5 28cea50945ec6972c8ec096bf562fb9e
- SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
- SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
- SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
- TLSH T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_ctypes.pyd
- Size 139KB
- SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
- MD5 fdda26bd63d43178c9aca5003f6a7e42
- SHA1 48037f1f68aad29e1002573337d2357f8972d045
- SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
- SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
- TLSH T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_lzma.pyd
- Size 157KB
- SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
- MD5 1f2c927c6f1773093e6939e0f0075997
- SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
- SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
- SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
- TLSH T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_socket.pyd
- Size 85KB
- SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
- MD5 893ee6bcfa6b5a527b61eceb80257871
- SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
- SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
- SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
- TLSH T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_ssl.pyd
- Size 180KB
- SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
- MD5 b9acce051643c39e5ac4c36110388724
- SHA1 69f9743a13c57f699ce68270d915159aa812103b
- SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
- SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
- TLSH T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_zstd.pyd
- Size 491KB
- SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
- MD5 256a79eff7505cc58fbf59d863c5c543
- SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
- SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
- SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
- TLSH T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\base_library.zip
- Size 1.3MB
- SHA256 5a5d737b2b6dff791ddd50d1751aa7746f3655b94beca30e65027b578c111916
- MD5 8ced80170d383aad3f8edd2060a88429
- SHA1 8497b923a2b0488cc78bd9ed602e916bc60c3259
- SHA512 9c004374f4515fb99d0197cda5a69ab8baf95960d139c17a4af597e3b87ea08ed09fe460d7d0f1a7a18ed546cbecece400f8406e4bf4250c28a86ccc350aa518
- SSDEEP 24576:PWuUF0L9QeOdP2m2dfARp0j3CGpd8lbSZ2:+uUF2/4Ry3CgdG
- TLSH T167552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\libcrypto-3.dll
- Size 5.0MB
- SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
- MD5 9751638ed5684f53f07ef6b4c7e8a786
- SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
- SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
- SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
- TLSH T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\libssl-3.dll
- Size 776KB
- SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
- MD5 a643b4a012da0d4b5653a01a458cabb7
- SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
- SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
- SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
- TLSH T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\python3.DLL
- Size 72KB
- SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
- MD5 303f286d14b7db861ad96314bd8bf3f7
- SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
- SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
- SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
- TLSH T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\python314.dll
- Size 6.5MB
- SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
- MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
- SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
- SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
- SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
- TLSH T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\pywin32_system32\pywintypes314.dll
- Size 133KB
- SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
- MD5 c11818bd607c6060902836c3f6bf024a
- SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
- SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
- SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
- TLSH T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\select.pyd
- Size 32KB
- SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
- MD5 9e31eff5c36a868a6010be873e0f58b5
- SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
- SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
- SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
- TLSH T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\unicodedata.pyd
- Size 740KB
- SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
- MD5 624ffa84aa15efced4c1fd8e5ccf0b95
- SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
- SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
- SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
- TLSH T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\win32\win32file.pyd
- Size 139KB
- SHA256 148bed72ad482d9b83a225c94cc1faf0c19f8bc3f7700a4db5ea944892dbb282
- MD5 63dad4df15e78e7d919a1e5b5f009722
- SHA1 4d94d7f77939098cef3fbfd4cec7b5f22ac853ca
- SHA512 e6f8b39df9f08e3ae6642fd287c207f1d25bd59c243e08ede5ac90b3e884f960b74e415a7708c65a8f685a566f9a9812d78712b09d74d95f3bcf8a225b2f286c
- SSDEEP 3072:hdZ3D5LAGncx6AuRKu134sKi9YxG2Ozai9YxvYsODfVrgU:hdZ3D5LLn0uKu13lNxFsODfV
- TLSH T1EBD339AB739510E6E95AE27DD4278D43E773B020076097CF0965CA4A0F273E67E39B84
- MD5 SHA1 SHA512 SSDEEP TLSH