Overview

overview

7

Static

static

3

Avarice.exe

windows10-ltsc_2021-x64

7

Avarice.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/08/2026, 11:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Avarice.exe
  • Size 9.7MB
  • Sample260801-nfct9atdpc
  • SHA256 dd5fce61f699c7649cf159389c799abfaf4dd69b0eeb09fe924e7db8a203656f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Avarice.exe
    "C:\Users\Admin\AppData\Local\Temp\Avarice.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\Avarice.exe
      "C:\Users\Admin\AppData\Local\Temp\Avarice.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3280
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:5092

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_asyncio.pyd
        • Size 62KB
        • SHA256 91d9bf73b360ba801ba595e90dbff182ef9c682331e2d39d210999a63d4bde54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_bz2.pyd
        • Size 81KB
        • SHA256 164f1bf42630b589b50c8f0c6e55aaa8d817e439a00882be036fff3cbe8e6ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_ctypes.pyd
        • Size 119KB
        • SHA256 147b080ceb8dfd6df865570addba3864659adef4b85a20b750f3ca6735c4bf1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_hashlib.pyd
        • Size 60KB
        • SHA256 583f6d20998e45ff94400efaeecc4e17204449a0cc7ba68a20d1e8d13617f27b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_lzma.pyd
        • Size 154KB
        • SHA256 8aa5cd82d775ea718d3ddd270f0b28985d8711ef937447ee2168318200f0eb80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_overlapped.pyd
        • Size 47KB
        • SHA256 b4c2156119bee84c5d153415d9fe802825a7179877b8943dc00c38a5c985eb7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_queue.pyd
        • Size 29KB
        • SHA256 c6d4f9c54efe7536bba4f9a2a4e7da46c5af74771ea2fa881287c61db9676986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_socket.pyd
        • Size 75KB
        • SHA256 8efdbacf67c223f47b608e57222cf80dd12cee163945847f6cfa9ea6c26ada36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_ssl.pyd
        • Size 155KB
        • SHA256 09fdf00110acfa4c3239de64d7955a625195625745559432a13e97c9d0e01368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\_uuid.pyd
        • Size 23KB
        • SHA256 4545291adffa28e6a16ec3867ce802cfcd49c791f5ec68bdcf0e2fcacadab258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\aiohttp\_helpers.cp310-win_amd64.pyd
        • Size 38KB
        • SHA256 7fb1086c725d934ccc23cd4c4e9848c685c2835d1953442dad7d7b09f64e895e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\aiohttp\_http_parser.cp310-win_amd64.pyd
        • Size 206KB
        • SHA256 e17a07f9e3856dc7a5d97780c3fa7ee6d7135adbacc2af57dc1be822196faa11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\aiohttp\_http_writer.cp310-win_amd64.pyd
        • Size 34KB
        • SHA256 0f2655d0e7c5c217efce351418ec988f03ba0bbaafa3cf4dcb94b36c0817fdcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _websocket.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\aiohttp\_websocket.cp310-win_amd64.pyd
        • Size 22KB
        • SHA256 c88f5edb5625d58c9a310fdda079606025fdcdea75206d273e1c05c600ead793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\base_library.zip
        • Size 1.0MB
        • SHA256 2b75d4950b2c67d3fe7292d496486392f2840519960dc2925f1970c1280b5599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\charset_normalizer\md.cp310-win_amd64.pyd
        • Size 10KB
        • SHA256 ab0a8fd8f085766a2a7001380e6ee219d5ae68d0194498eeb8d3866f922fbcae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
        • Size 114KB
        • SHA256 1a6961fd249dbb3a9ccc903fe5ec4631616594edefb19db423fb488b3dba619a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _frozenlist.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\frozenlist\_frozenlist.cp310-win_amd64.pyd
        • Size 51KB
        • SHA256 b308520ecd7115aad210492bf6c1ce9b7df9decd31107e73c50c22e5edda63a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _message.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\google\_upb\_message.pyd
        • Size 732KB
        • SHA256 3a5b06fb42de9503eb7637add6139649e9349528e47be4888851555d115bee64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        messages.properties
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\langdetect\utils\messages.properties
        • Size 42KB
        • SHA256 0b21c8d7329e50acf3ddcb3906fa412cdc0f7dab6b44905a27716dfe086ef5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\multidict\_multidict.cp310-win_amd64.pyd
        • Size 45KB
        • SHA256 36605decfa10a79ab7281b6d49cc10724678018036e3ee3f6c77013a4f2174af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\python3.dll
        • Size 63KB
        • SHA256 82fc45243160de816b82c1c0412437bd677f0d1e53088416555a6e9e889734e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\python310.dll
        • Size 4.3MB
        • SHA256 cdb8158dcf4f10517bd73e1334fc354fd98180d4455f29e3df2b0aa699fa2432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\select.pyd
        • Size 28KB
        • SHA256 2bfa63b823c54d6b3c55dc17e446129fc02ca930d247abadbc7680f0f71d03a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\unicodedata.pyd
        • Size 1.1MB
        • SHA256 a84f488f2ae2a74268da36bd8c3fe7b6e8d2b9b89a3c99f5173a827a8ddca2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47322\yarl\_quoting_c.cp310-win_amd64.pyd
        • Size 66KB
        • SHA256 15212784818a219a256305bfda100bb7508e9816bed77373a8957dbbd1324149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3280-154-0x000000005F590000-0x000000005F635000-memory.dmp
        Download