Analysis
- user interaction
yes - max time kernel
3s - max time network
5s - platform
windows10-2004_x64 - resource
win10v2004-20260513-ja - resource tags
arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows - submitted
04/08/2026, 11:57
Behavioral task
behavioral1
Sample
TrojanBsod.exe
Resource
win10v2004-20260513-ja
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
TrojanBsod.exe
Resource
win11ltsc2024-20260709-ja
3 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target TrojanBsod.exe
- Size 7.0MB
- Sample260804-n4yfvsdr2x
- SHA256 e3bb4a23640c4faa148190acb405fc79591ba07672a36b9e064fb753b1df0098
- MD5 f1e433df1b24918d398fafe65685b7df
- SHA1 0153acc8e7152fd56e4b8f221aad1144d5977041
- SHA512 77988bf3b3018f59d347d0174de414e55d1cd6647e7e470e474db2909d3cdfb1d75e49e0feb8135f0e1cea3e8daacf1f4d1c0b1cb2ddbff77031ef8104c9d41c
- SSDEEP 98304:p8fUGQ0nuaZJhiZGxuZhCMYkcIt5FkOwSrIcUsLXRL2wb3p8FPg6XwKsmF:peFuoJhiZyurH/P/XRLcP2KsmF
- TLSH T102763338A7A511F7F9E6E33C8991C472C6667C162711C6D383E489B63D336D06A3B362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 5928 TrojanBsod.exe 5928 TrojanBsod.exe 5928 TrojanBsod.exe 5928 TrojanBsod.exe 5928 TrojanBsod.exe 5928 TrojanBsod.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 5928 TrojanBsod.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5576 wrote to memory of 5928 5576 TrojanBsod.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5928
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\_bz2.pyd
- Size 83KB
- SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
- MD5 684d656aada9f7d74f5a5bdcf16d0edb
- SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
- SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
- SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
- TLSH T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\_ctypes.pyd
- Size 130KB
- SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
- MD5 29873384e13b0a78ee9857604161514b
- SHA1 110f60f74b06b3972acd5908937a40e078636479
- SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
- SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
- TLSH T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\_decimal.pyd
- Size 273KB
- SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
- MD5 21fcb8e3d4310346a5dc1a216e7e23ca
- SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
- SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
- SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
- TLSH T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\_hashlib.pyd
- Size 63KB
- SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
- MD5 3e540ef568215561590df215801b0f59
- SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
- SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
- SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
- TLSH T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\_lzma.pyd
- Size 155KB
- SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
- MD5 d63e2e743ea103626d33b3c1d882f419
- SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
- SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
- SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
- TLSH T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\_socket.pyd
- Size 83KB
- SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
- MD5 566cb4d39b700c19dbd7175bd4f2b649
- SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
- SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
- SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
- TLSH T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\base_library.zip
- Size 1.3MB
- SHA256 93a7c4245ab34b278c47fabf261f36346cee120aabb0089d451fa1aba90b8a04
- MD5 654886278b316a6b4dc2b562e28d56c3
- SHA1 beae29232635b96f151c9449cc91f514f13144cd
- SHA512 9e93aed8b4bbb04d2de70744f0538d52f9a69c4499bd4275d4245cbe7f188289ab82fbd7202c880af840ce2da93f966bb0d8b4c5c58f3eab6c559ca2fdc2d5d3
- SSDEEP 12288:cEwUJL+DNRf6gi2cPPdxhY6nxO1W7Wp+35cuOBa80201jwCVRDVoioSYB7+djdTg:cEQ5cPPdxhY6nl7WprzCdZbSeT1K5
- TLSH T172551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\python313.dll
- Size 5.8MB
- SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
- MD5 7387fe038ea75eb9a57b054fccfe37bf
- SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
- SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
- SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
- TLSH T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\select.pyd
- Size 31KB
- SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
- MD5 715a098175d3ca1c1da2dc5756b31860
- SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
- SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
- SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
- TLSH T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI55762\unicodedata.pyd
- Size 695KB
- SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
- MD5 503b3ffa6a5bf45ab34d6d74352f206b
- SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
- SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
- SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
- TLSH T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH