Analysis
- max time kernel
2s - max time network
7s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:57
Behavioral task
behavioral1
Sample
TrojanBsod.exe
Resource
win10v2004-20260513-ja
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
TrojanBsod.exe
Resource
win11ltsc2024-20260709-ja
3 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target TrojanBsod.exe
- Size 7.0MB
- Sample260804-n4yfvsdr2x
- SHA256 e3bb4a23640c4faa148190acb405fc79591ba07672a36b9e064fb753b1df0098
- MD5 f1e433df1b24918d398fafe65685b7df
- SHA1 0153acc8e7152fd56e4b8f221aad1144d5977041
- SHA512 77988bf3b3018f59d347d0174de414e55d1cd6647e7e470e474db2909d3cdfb1d75e49e0feb8135f0e1cea3e8daacf1f4d1c0b1cb2ddbff77031ef8104c9d41c
- SSDEEP 98304:p8fUGQ0nuaZJhiZGxuZhCMYkcIt5FkOwSrIcUsLXRL2wb3p8FPg6XwKsmF:peFuoJhiZyurH/P/XRLcP2KsmF
- TLSH T102763338A7A511F7F9E6E33C8991C472C6667C162711C6D383E489B63D336D06A3B362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 6128 TrojanBsod.exe 6128 TrojanBsod.exe 6128 TrojanBsod.exe 6128 TrojanBsod.exe 6128 TrojanBsod.exe 6128 TrojanBsod.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 6128 TrojanBsod.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2320 wrote to memory of 6128 2320 TrojanBsod.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"C:\Users\Admin\AppData\Local\Temp\TrojanBsod.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_bz2.pyd
- Size 83KB
- SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
- MD5 684d656aada9f7d74f5a5bdcf16d0edb
- SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
- SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
- SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
- TLSH T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_ctypes.pyd
- Size 130KB
- SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
- MD5 29873384e13b0a78ee9857604161514b
- SHA1 110f60f74b06b3972acd5908937a40e078636479
- SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
- SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
- TLSH T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_lzma.pyd
- Size 155KB
- SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
- MD5 d63e2e743ea103626d33b3c1d882f419
- SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
- SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
- SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
- TLSH T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\base_library.zip
- Size 1.3MB
- SHA256 93a7c4245ab34b278c47fabf261f36346cee120aabb0089d451fa1aba90b8a04
- MD5 654886278b316a6b4dc2b562e28d56c3
- SHA1 beae29232635b96f151c9449cc91f514f13144cd
- SHA512 9e93aed8b4bbb04d2de70744f0538d52f9a69c4499bd4275d4245cbe7f188289ab82fbd7202c880af840ce2da93f966bb0d8b4c5c58f3eab6c559ca2fdc2d5d3
- SSDEEP 12288:cEwUJL+DNRf6gi2cPPdxhY6nxO1W7Wp+35cuOBa80201jwCVRDVoioSYB7+djdTg:cEQ5cPPdxhY6nl7WprzCdZbSeT1K5
- TLSH T172551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\python313.dll
- Size 5.8MB
- SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
- MD5 7387fe038ea75eb9a57b054fccfe37bf
- SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
- SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
- SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
- TLSH T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
- MD5 SHA1 SHA512 SSDEEP TLSH