Overview

overview

7

Static

static

3

Qwen_pytho...yu.exe

windows10-ltsc_2021-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    04/08/2026, 01:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Qwen_python_20260804_l7afaimyu.exe
  • Size 6.9MB
  • Sample260804-bepq7stsas
  • SHA256 459885857368e5761aae02b0f948e5652c417e5a2a6095735638a0f0bfa52497
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Qwen_python_20260804_l7afaimyu.exe
    "C:\Users\Admin\AppData\Local\Temp\Qwen_python_20260804_l7afaimyu.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Users\Admin\AppData\Local\Temp\Qwen_python_20260804_l7afaimyu.exe
      "C:\Users\Admin\AppData\Local\Temp\Qwen_python_20260804_l7afaimyu.exe"
      2⤵
      • Loads dropped DLL
      PID:2252
  • C:\Windows\system32\atbroker.exe
    atbroker.exe /start magnifierpane
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\System32\ATBroker.exe
      C:\Windows\System32\ATBroker.exe /start magnifierpane
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\System32\Magnify.exe
        "C:\Windows\System32\Magnify.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_bz2.pyd
        • Size 82KB
        • SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_decimal.pyd
        • Size 247KB
        • SHA256 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_hashlib.pyd
        • Size 63KB
        • SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_lzma.pyd
        • Size 155KB
        • SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_socket.pyd
        • Size 77KB
        • SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_uuid.pyd
        • Size 24KB
        • SHA256 c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\base_library.zip
        • Size 1.4MB
        • SHA256 72f8d1b4c896caa8a562b6fd464c89db21925cf7f15b8b0a33a6f0dfbd81b0ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\python311.dll
        • Size 5.5MB
        • SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\select.pyd
        • Size 29KB
        • SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\unicodedata.pyd
        • Size 1.1MB
        • SHA256 b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SP_7B88AFAC44F3447BB5F2734CF70B01AF.dat
        • Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_7B88AFAC44F3447BB5F2734CF70B01AF.dat
        • Size 940B
        • SHA256 4415de42d954a7ccf9f4ef5304c0219de64dc2d2fab82f500993a11eef4cbf27
        • MD5 SHA1 SHA512 TLSH
        Submit Download