584a3cb1fe6ade8c84c7f988d4a258f02021c69131fa6f363950242745468707

Analysis

user interaction
yes
max time kernel
20s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
detect Setup 2.9.6382.exe
Size 5.7MB
Sample260731-helg4sec33
SHA256 584a3cb1fe6ade8c84c7f988d4a258f02021c69131fa6f363950242745468707
MD5 cf4fb8017813b3cb8dcc83576a99b491
SHA1 6f8c3f62ccde7d48c984d2fedf70756772691089
SHA512 b7d190e67304a25e3d40cfe09c404b694b7931b2d6f163ef2d2e6c150027028e73e2dbb77d38398c18f9d97e1216620f573718805f3d7c896608f0d131db3781
SSDEEP 98304:vUIRIKIhqhpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTHMzGR:sW7Ihqh9onJ5hrZEnyiU8AdZYJERurTS
TLSH
T10456334CB28120ECE8379A3A4741C924F6B37D9B47E1D6DBA36CB3363A935D14D78624
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1940	detect Setup 2.9.6382.exe
1940	detect Setup 2.9.6382.exe
1940	detect Setup 2.9.6382.exe
1940	detect Setup 2.9.6382.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
924	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1940	3840	detect Setup 2.9.6382.exe	89
PID 1940 wrote to memory of 924	1940	detect Setup 2.9.6382.exe	90

C:\Users\Admin\AppData\Local\Temp\detect Setup 2.9.6382.exe
"C:\Users\Admin\AppData\Local\Temp\detect Setup 2.9.6382.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\detect Setup 2.9.6382.exe
  "C:\Users\Admin\AppData\Local\Temp\detect Setup 2.9.6382.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /c C:\Users\Admin\AppData\Local\Temp\deploy_yUkp8EWvsJn38sVgL.bat
    3⤵
    - Executes a command shell one-liner
    PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\VCRUNTIME140.dll
Size 99KB
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
SSDEEP 1536:7y6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bIB0TO:7lXfRXqQw+PHLrCZh9xecbSt
TLSH
T147A36B4AB6A442B7D16AC174C4F39A47EB31B485873053CF03B58AA90F67BE15E3E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\_bz2.pyd
Size 83KB
SHA256 fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a
MD5 6c7565c1efffe44cb0616f5b34faa628
SHA1 88dd24807da6b6918945201c74467ca75e155b99
SHA512 822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22
SSDEEP 1536:du9pb+4t6286gTWPh1avDJjNcnl8rDHiCdgoIh4Vdye:Y/4286g6PhwbJjNcnKrDHiWJIh4V7
TLSH
T118837C42B36096F5F09BF27896614247E332FD19039093EFB6A8425B2F13F912D6971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\_decimal.pyd
Size 264KB
SHA256 ffbe84f0a1eab363ca9cf73efb7518f2abd52c0893c7cc63266613c930855e96
MD5 ce4df4dfe65ab8dc7ae6fcdebae46112
SHA1 cdbbfda68030394ac90f6d6249d6dd57c81bc747
SHA512 fc8e39942e46e4494356d4a45257b657495cbfa20e9d67850627e188f70b149e22603ae4801b4ba7b9a04d201b3787899d2aee21565237d18e0afce9bae33ee9
SSDEEP 6144:NZvKcJQiRhmo/KmsHkD96sIlBgZnIDQVGz9qWMa3pLW1An3nS1fSajGjY+CKT2:JQiRhXKPdg5abjY+p2
TLSH
T1B2445B56A3490CA4EA73807899979B47E7F278940360D7CF43B48AA73F53792637E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\_hashlib.pyd
Size 63KB
SHA256 9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac
MD5 f377a418addeeb02f223f45f6f168fe6
SHA1 5d8d42dec5d08111e020614600bbf45091c06c0b
SHA512 6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280
SSDEEP 768:k8JtPzXIvBbB+TXS/NnjtQWCYDhYF7POfex7ooIhsIAKWDG4y1b:NZIvBbB+TXS9ZQVYutOfO7ooIhsI6y1b
TLSH
T1E053394AA74910E5D8B741BDC8630E97E671F6111301A3DF93A8C28E2F23BD76376B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\_lzma.pyd
Size 157KB
SHA256 b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5
MD5 b5355dd319fb3c122bb7bf4598ad7570
SHA1 d7688576eceadc584388a179eed3155716c26ef5
SHA512 0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5
SSDEEP 3072:plVImSOG2/K/clbGT5twoLPw8Eo5KZznfo9mNo+lPWiruUpzJIhH1d:plVImSOGoK/gGT1t5KhQYO+lbrbxY
TLSH
T1A2F32986B394F0E6F3228C78D6624F57E6F578190310929E02CD876E2B1FB755A2E317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\_socket.pyd
Size 77KB
SHA256 4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
MD5 f5dd9c5922a362321978c197d3713046
SHA1 4fbc2d3e15f8bb21ecc1bf492f451475204426cd
SHA512 ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99
SSDEEP 1536:IEup3XVzjtJVW1TEAb9/s+m+p13SrpZfLL+kn8AIhVw4yZ:CV3tUwAb9/sb+pFSrbf+knFIhVwl
TLSH
T149736B01A79151F9D6B3C076C6678F63F7B0F4901395A38F4164CA5A1F237C2AE3AB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\base_library.zip
Size 822KB
SHA256 f109a98251c1c90c02e7462d0304508dc676dbe97c67e46d80447c7259f890ec
MD5 181e357caecae06fa08df2272bfa1d6f
SHA1 a78d49bfdd21b768208e8bf243860e857b40cc01
SHA512 42d27271de7b95d66b4ba91c4e4d89d3e8874c9e0cb1e77b35336cbd59bca642b5277017eda90daaafbae135283e62cb01599e49d012aa4d6552abe4a7af086e
SSDEEP 24576:8oUE0WHkq+cnfVEgVwHawcosQNRs54PK4ItQ:BHkq+cElcosQNRs54PK4IC
TLSH
T17B0508407AA26ED7FD09F27D412ECA1C4A6A5239DB48D203794FC3983F4B3E01E76959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\libcrypto-1_1.dll
Size 3.2MB
SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
MD5 cc4cbf715966cdcad95a1e6c95592b3d
SHA1 d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA512 3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
SSDEEP 98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
TLSH
T162F58C5AA7AC1194E5BAC07CC9574727E3B1B85A83B05BCF08B681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\python39.dll
Size 4.3MB
SHA256 0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
MD5 11c051f93c922d6b6b4829772f27a5be
SHA1 42fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA512 1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6
SSDEEP 49152:1kYH+B/E8d7YHDCxJvUIIHd4hP8wuqNdOMFit/gxSwzaBuv4lz1ZRVgwWFJfzMpg:zo7Yq0a2YaCIIzcHxJ7HtMU5weHWeMt
TLSH
T163267B22639411A4DEB79477C5278706CBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\select.pyd
Size 26KB
SHA256 1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
MD5 7a442bbcc4b7aa02c762321f39487ba9
SHA1 0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83
SHA512 3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c
SSDEEP 384:1AEYe1nJzV3mynQwhS/hHq++4XvPAr70cElZ8AIhqGLnYPLxDG4y8eKAtO:FBBDnQwhihHq2v8uZ8AIhqGLWDG4y0iO
TLSH
T124C27D46B76470DAE5B7C170D9A28F17E831B262476482DF2268C2681F72BC1363B71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38402\unicodedata.pyd
Size 1.1MB
SHA256 7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae
MD5 8320c54418d77eba5d4553a5d6ec27f9
SHA1 e5123cf166229aebb076b469459856a56fb16d7f
SHA512 b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34
SSDEEP 12288:teTMmuZ63NHQCb5Pfhnzr0ql8L8kUM7IRG5eeme6VZyrIBHdQLhfFE+uRbenwr:teTuoZV0m8MMMREtV6Vo4uYR9r
TLSH
T107355909BEC24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EE652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deploy_yUkp8EWvsJn38sVgL.bat

Path C:\Users\Admin\AppData\Local\Temp\deploy_yUkp8EWvsJn38sVgL.bat
Size 843KB
SHA256 35a7b69ebdd1cd28efcada2213f1a0b5f97acbbf8385dcd7373e0d3d4ef1cfb5
MD5 f2fc39a72846086cac173153904554fe
SHA1 5e076626bc7ea1db0d4e14b1a5ceb358949ed600
SHA512 2ee5aa4914371207fed79f91aed4414bfb460716331fba2b87bb91a82e9e20dedbe12f5719b8ce215ddb405b2fdd13d7900ef10abb712d28a21071db7675805e
SSDEEP 24576:hoSxI3sA+DzVXeRohzZ2ZBORuy8p0SXv96Yh:OSyiWoLDUCUl6Yh
TLSH
T1A5050175FAC20D1EABBA167EB4D5C7037F68C1C3053451CED6EE0249474E58A86BB22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads