Overview

overview

7

Static

static

5

XtcBypasser.exe

windows10-2004-x64

7

XtcBypasser.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XtcBypasser.exe
  • Size 37.9MB
  • Sample260806-dbvt6axtdz
  • SHA256 cdfb164b4743e68dfe82954e42c53961d7f96d011da76634f582ebeee7ea2e3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 51 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XtcBypasser.exe
    "C:\Users\Admin\AppData\Local\Temp\XtcBypasser.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Users\Admin\AppData\Local\Temp\XtcBypasser.exe
      C:\Users\Admin\AppData\Local\Temp\XtcBypasser.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2856

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtOpenGL.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\QtOpenGL.pyd
        • Size 1.1MB
        • SHA256 5e19e91fd636b336c8b0e58f1b333ca56fa0d2a7d7dfbd9af5bd7223f545687f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 a5e78921d92d4b4975edbd441369ef7ab689e336d1b40d8555728880f0503fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\sip.pyd
        • Size 108KB
        • SHA256 9b9bcfc6b5a72197dc56bbc91bdcf95c4e243e5fba731ca6b2f8e5412535f3c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt6Core.dll
        • Size 9.8MB
        • SHA256 b98eea394a95563879b614dbd4432ce074b0fceeb154c3bae252f4e7a9376a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 28ca8b9e7d3d1c4e3cfafd6fe63877a05cf10202a240134a11f98384f01c9e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
        • Size 84KB
        • SHA256 df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
        • Size 34KB
        • SHA256 0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
        • Size 177KB
        • SHA256 eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\python3.dll
        • Size 70KB
        • SHA256 ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 9306ceffdc3b663f90fc446800be4ab870887c0bf3c38dc16b00e070e519d895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 78f1acd16154a241101ead83c845388394526b9e4ddc7bdc914d22d96710f7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtOpenGLWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\PyQt6\QtOpenGLWidgets.pyd
        • Size 68KB
        • SHA256 64d30ce9652b0eccde94c613a02c9b7029005219c39fb73c6c93d34222ff4427
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XtcBypasser.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\XtcBypasser.dll
        • Size 34.0MB
        • SHA256 5c43cae2c6ea17ca0cb9eacb311cd0e65faa67d8a04551cff2c0e7632c42158f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\_ctypes.pyd
        • Size 131KB
        • SHA256 c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\_hashlib.pyd
        • Size 67KB
        • SHA256 8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\_lzma.pyd
        • Size 155KB
        • SHA256 1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\_socket.pyd
        • Size 84KB
        • SHA256 a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\_wmi.pyd
        • Size 38KB
        • SHA256 1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\msvcp140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\msvcp140_2.dll
        • Size 188KB
        • SHA256 24b47c966b6e4a65b3e4df866d347d3427e9bd709be550c38224427eb5e143d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\python313.dll
        • Size 5.8MB
        • SHA256 265a27242ee97f81eeac6a556fd7de56baff2222f2334386d8f948e359a649d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6opengl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\qt6opengl.dll
        • Size 1.9MB
        • SHA256 a41b71127d07924ddda67e787e8765ebf60f217817199f1becdd63f3db88847e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6openglwidgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\qt6openglwidgets.dll
        • Size 62KB
        • SHA256 55e11e28c82b69ac67725ebdf05f0c703a2ea3b1443b141d37d537a34ac45e18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\qt6widgets.dll
        • Size 6.3MB
        • SHA256 f383fb6b3f6996efe23327ff607e7298fc47ee76e8b8ef8a65f8d2e0a91707e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4512_134304582573490772\select.pyd
        • Size 32KB
        • SHA256 7d061afc87ba79f90878af39a1ebc7b4cf238d52e5bbe16ff7e176cbba266ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2856-129-0x00007FFE9EC10000-0x00007FFE9F0F0000-memory.dmp
        Download

        memory/2856-137-0x00007FFE9E9D0000-0x00007FFE9EC04000-memory.dmp
        Download

        memory/2856-134-0x00007FFE9F900000-0x00007FFE9FB8D000-memory.dmp
        Download

        memory/2856-127-0x00007FFE9C7A0000-0x00007FFE9CDE7000-memory.dmp
        Download

        memory/2856-166-0x00007FF6C5DA0000-0x00007FF6C6DA0000-memory.dmp
        Download

        memory/4512-165-0x00007FF6C5DA0000-0x00007FF6C6DA0000-memory.dmp
        Download