Overview

overview

7

Static

static

3

OverlayX.exe

windows10-2004-x64

7

OverlayX.exe

windows11-ltsc_2024-x64

7

launcher.pyc

windows10-2004-x64

3

launcher.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 08:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OverlayX.exe
  • Size 46.0MB
  • Sample260806-kkeymaxckh
  • SHA256 cd7566aa3efc9b5a9526721f761dfa163604039f09d83f9f70f9c82429c25817
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 42 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OverlayX.exe
    "C:\Users\Admin\AppData\Local\Temp\OverlayX.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Users\Admin\AppData\Local\Temp\OverlayX.exe
      "C:\Users\Admin\AppData\Local\Temp\OverlayX.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3176

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PresentMon-2026-07-24T111016.csv
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PresentMon\PresentMon-2026-07-24T111016.csv
        • Size 153KB
        • SHA256 2a939c20915449ee4733747a647e9e64de24249c414928fccfe7ecb80181972c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PresentMon.exe
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PresentMon\PresentMon.exe
        • Size 934KB
        • SHA256 9bec3083069f58f911e6a512f4806db51a27bd096103087bc1d05ef54c80a191
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\MSVCP140_1.dll
        • Size 26KB
        • SHA256 b2113956aa3fcb9decfe65be1ee7829f8e3ae0899633ae89fe04888ada201594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\MSVCP140_2.dll
        • Size 265KB
        • SHA256 1b806b427ffb573deff8478cf6fe336465fe2c67e0919bb95f452b6f31d25736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\Qt6Core.dll
        • Size 10.0MB
        • SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 f0549716b10a8b4fbd5c6c041f36af215223809f919f4c4722d44cc199d5c593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\PySide6\pyside6.abi3.dll
        • Size 242KB
        • SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_bz2.pyd
        • Size 85KB
        • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_ctypes.pyd
        • Size 139KB
        • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_lzma.pyd
        • Size 157KB
        • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_queue.pyd
        • Size 35KB
        • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_socket.pyd
        • Size 85KB
        • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_wmi.pyd
        • Size 39KB
        • SHA256 0ab1fbcf18c95d70343012feb1aad61e1ba95aaed5b4a08e57fc5990e8a9a452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_zstd.pyd
        • Size 491KB
        • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.ico
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\assets\icon.ico
        • Size 560B
        • SHA256 81a31fd1e48936a8ecafb7b57b6468350e6bf910ae3ecc192b37b10c9d14fa8e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autoclicker.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\autoclicker.py
        • Size 20KB
        • SHA256 426c00919957c3042ccf67853a9d19223f30a7448814ea4eb14fbfd35b3a77a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\base_library.zip
        • Size 1.3MB
        • SHA256 f3eb09e33a988a0208e6fcbb7253c17f5092b7c7874061fba68bdf7b97e3723b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\config.json
        • Size 145B
        • SHA256 dc96c91447370bdcdca7704292379a879414107abf028ddb7bbc94fb85b980c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        filterkeys.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\filterkeys.py
        • Size 28KB
        • SHA256 c091f636ed08b32753171585a130f88dff1d4f86caa5d17e50e0184b198c5d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        filterkeys_config.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\filterkeys_config.json
        • Size 382B
        • SHA256 949357cf57df23c7b58669ecdae0ecd468cbea4a48b1e4860836a5d8eadd7457
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fps.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\fps.py
        • Size 3KB
        • SHA256 bf68ba492dcba33175f14de75438b66be4f24f0840fd0dd23bd586812dc5b0ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\main.py
        • Size 8KB
        • SHA256 dedc32ecc468e6ba75c65fa33f6f916730374861267934fb059875a8b225876f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        overlay.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\overlay.py
        • Size 21KB
        • SHA256 fbb65f9b763e7fb62ac5d47db1042bb918efc9dc49af2b37f312b3ba52fce2b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\python3.DLL
        • Size 72KB
        • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\python314.dll
        • Size 6.5MB
        • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\settings.json
        • Size 742B
        • SHA256 ad00d797b498515f688f9e84cbb94e60f30f637e1639538cf74ac36685606bdf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        settings.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\settings.py
        • Size 27KB
        • SHA256 ac256fe1a2b2dedee8b7bae6866c4cdd893b61e56afb01500ec58a00e2db5974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\shiboken6\MSVCP140.dll
        • Size 536KB
        • SHA256 005f2324c7ff79bbe9a44992b0708abb4c871bd24bcc7a34aca5eab4439c1f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\shiboken6\VCRUNTIME140_1.dll
        • Size 40KB
        • SHA256 e4d7ea5f4f4ff6d0c208e693853617cdef0ad71cfe5dd5c3ae16c8a6b64c18ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\shiboken6\shiboken6.abi3.dll
        • Size 375KB
        • SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3176-259-0x00007FFC117B0000-0x00007FFC11B6B000-memory.dmp
        Download

        memory/3176-264-0x00007FFC109B0000-0x00007FFC10E69000-memory.dmp
        Download

        memory/3176-218-0x00007FFC14950000-0x00007FFC14C83000-memory.dmp
        Download

        memory/3176-265-0x00007FFC10360000-0x00007FFC109AD000-memory.dmp
        Download

        memory/3176-274-0x000001E858DE0000-0x000001E858DF0000-memory.dmp
        Download