Overview

overview

7

Static

static

3

UtiliVeraI...64.exe

windows10-2004-x64

7

UtiliVeraI...64.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 00:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UtiliVeraImage-Windows-x64.exe
  • Size 33.6MB
  • Sample260809-ajgeysxalg
  • SHA256 c9c92aee77bbb9ee0f6313fb0da3c0a155f9b8f6cf658b4a94e5d4f193fd1343
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 33 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UtiliVeraImage-Windows-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\UtiliVeraImage-Windows-x64.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\UtiliVeraImage-Windows-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\UtiliVeraImage-Windows-x64.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _avif.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\PIL\_avif.cp312-win_amd64.pyd
        • Size 7.5MB
        • SHA256 6731dce52baab0b96b0eeb3c664844b5b42c2168ea8668af2430e2fbdd2dfbd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\PIL\_imaging.cp312-win_amd64.pyd
        • Size 2.5MB
        • SHA256 c8c519ec72bf75b2945b4fc4afa854af2fca8b970a403134f9ddda3e164d85e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imagingcms.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\PIL\_imagingcms.cp312-win_amd64.pyd
        • Size 266KB
        • SHA256 c89c633ae1bf3f26a327d14ff688db66628e19c9866ab925479f27dcb60a2d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imagingft.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\PIL\_imagingft.cp312-win_amd64.pyd
        • Size 2.1MB
        • SHA256 77c6d37de41733df40fb36d9af47644989ac17da036515e759303969edb22c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        THIRD-PARTY-NOTICES.md
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\THIRD-PARTY-NOTICES.md
        • Size 1KB
        • SHA256 3aef0aa8ba58891ba33aba72f961f2e771d6e8c5a3aeee3a601253e2b8884d3c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_bz2.pyd
        • Size 71KB
        • SHA256 969b76222584b7ad1da3e8e1a4bc45f1f892dc47f2996e883dde5feb398a91a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_ctypes.pyd
        • Size 113KB
        • SHA256 7282d8f2b41cd565e8df0e87a42c79accaa7fedc133137552d49dfbc006f34c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_decimal.pyd
        • Size 240KB
        • SHA256 fcdc8bc61ee2dac17fbb9a8eea45242e22a34d1a71abac9bee7f732dc3f8b79f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_elementtree.pyd
        • Size 119KB
        • SHA256 46dabdeec004a4a94a1a65169f2867a2ce648555101301716d630b792b7f1650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_hashlib.pyd
        • Size 53KB
        • SHA256 f0a3f3c8ced4be5efc3cb47e4de8320a0c59852b52310e1cb0541a56b0cc42ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_lzma.pyd
        • Size 149KB
        • SHA256 fc151659d1083706c7cc76d459b8cb9393d3b37897bba398928f410791f38f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_multiprocessing.pyd
        • Size 23KB
        • SHA256 66a7f033dd26d4c4f6717576fe4fa47b2fdb84ab6b564f05b7452b31a0ebd039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pillow_heif.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_pillow_heif.cp312-win_amd64.pyd
        • Size 51KB
        • SHA256 7af06daeeabe64e46eef237a98c1469568dbca8872c4544277eba075e63b25a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_queue.pyd
        • Size 20KB
        • SHA256 04ff7d983ac5e4659aac51145be4e39e3b0aedd15a3df2c3ebfeb8570f83905a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_socket.pyd
        • Size 70KB
        • SHA256 762e124059728986555e815698fb9ce0cf3c50e84adb6ba0df4a96d324079a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_ssl.pyd
        • Size 161KB
        • SHA256 31bed7c9c6e8e997e9cf92ec40d250269c80e8a0d2216be3b5afefd26f038c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_tkinter.pyd
        • Size 54KB
        • SHA256 c136b8326d08144f5e7b1d178c5bc35295d43f82039ac22df9b0d87120e37084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_uuid.pyd
        • Size 13KB
        • SHA256 dc53e95f037f17c5665fb4aa729e273e3c6dc49017f3df7f8d7ecb631e04495c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\_wmi.pyd
        • Size 25KB
        • SHA256 7399862a3be13b981553b7fa2e1a64b2f8cda92c15c5966faf81a514d36210f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\base_library.zip
        • Size 1.3MB
        • SHA256 210c2d1541713afd7e5b76afc5520b2e7b8b5c47a8d2bd61e2c1cad7fbc9801d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\customtkinter\assets\themes\blue.json
        • Size 4KB
        • SHA256 a9c10c997a2281b57b60ff9325c9c0b2dbebe498722f3fbc7c585ec9fe1aa352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 e3575b8d13adfa7693ca7f8b7e4f94f24df33c8d64085972e28c213e225ddcb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libde265-0-8d972a940366aaf7eaf6705a22de8e57.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libde265-0-8d972a940366aaf7eaf6705a22de8e57.dll
        • Size 918KB
        • SHA256 4e59522a0d3a6ac23329470e9e69ccfe4862fea9066d02fe2c237468456a4e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libffi-8.dll
        • Size 27KB
        • SHA256 1163e242ec38a0de598ba7956353987c7167c0c6d5000625c3b3fc6e75669206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libgcc_s_seh-1-eff8eb7fc68513c933e71e04fe268e33.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libgcc_s_seh-1-eff8eb7fc68513c933e71e04fe268e33.dll
        • Size 146KB
        • SHA256 be58366160fe3cec95c52010d8f66925d45b0ac745a7f4e8c2af9c869f48c155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libheif-0840364bf533381e2055ff41f7009c9b.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libheif-0840364bf533381e2055ff41f7009c9b.dll
        • Size 2.1MB
        • SHA256 e99a445918cdcd24836bf0aa7270048cdff4fd249b3c429c0c18996222b7b21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libssl-3-x64.dll
        • Size 1.5MB
        • SHA256 28143bcd23fb00b7fabd66fdfba23a68640862f1fb1582d6ec581419afd206be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libstdc++-6-07ab034ef92ed1ea9b917556d8b72f2e.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libstdc++-6-07ab034ef92ed1ea9b917556d8b72f2e.dll
        • Size 2.5MB
        • SHA256 e7ef0782bca27dd4ef634102fbc008cf2e7acb6445e2b5499e157a13cf98e1ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libwinpthread-1-f484ca5635ab90fd518c1beecebe8822.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libwinpthread-1-f484ca5635ab90fd518c1beecebe8822.dll
        • Size 61KB
        • SHA256 f484ca5635ab90fd518c1beecebe8822b94541097fc0ccd93fe006b9f4dce1b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libx265-216-885aab310b379ba9f4fa0512bcdfba9d.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\libx265-216-885aab310b379ba9f4fa0512bcdfba9d.dll
        • Size 21.5MB
        • SHA256 6515320e02d05bd3314ad29d74c6b4056c318e41b485aaaec9526c4e76f3fa17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _avif.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\pillow_avif\_avif.cp312-win_amd64.pyd
        • Size 15.3MB
        • SHA256 829838960811464fb5c413858d879bee4545749bc402bdf68679ee012eaa23cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\pyexpat.pyd
        • Size 199KB
        • SHA256 0480cea6b86a8d99bfd735666aa7966ac252bd74d97de0bf5dcd19c2452d8e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\python312.dll
        • Size 6.6MB
        • SHA256 960a3863c9cb129f946bbc28947ebcdc9ebaec16afee2c10764bdfed61416556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\select.pyd
        • Size 18KB
        • SHA256 b241c5d193e5723ac56a2ac070123c78f5c515fb5ee252aca57b0874257e5b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tcl86t.dll
        • Size 1.8MB
        • SHA256 59488f67a8e75a5d51c7cb865436b5581fbb16014e9233b34db0c22bea6d4765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tk86t.dll
        • Size 1.5MB
        • SHA256 e9a5815ad39619e22d581b7124bbaa4192e701229956a2edbaffc0c420864561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd.tcl
        • Size 18KB
        • SHA256 d47acfd2e2d5426c40e8f5c11646c49a7ecdadc92c73f9c3f47eb0ea6fbba4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_compat.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd_compat.tcl
        • Size 6KB
        • SHA256 58b0aebd287df1d2cfe16231847b786ac9a3a2d18fff2a8a37955510221d10f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_generic.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd_generic.tcl
        • Size 25KB
        • SHA256 100d8b4199809f387b06cad1736f82536238c74ddbf7c6a87abbc1aa62cbbdf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_macosx.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd_macosx.tcl
        • Size 6KB
        • SHA256 8df2832dd834cd5347f42ef62a9fd8c14b6b473e2a9f8007db6c31a606ca4ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_unix.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd_unix.tcl
        • Size 36KB
        • SHA256 0e47675869457d52c13ee82403800984e27662976728146b475d66a89fc086cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_utils.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd_utils.tcl
        • Size 9KB
        • SHA256 fff7b046dfa50992dd3151c74291558c13a675efcaa758ce53d4d4a6ebebbb43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_windows.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\osx-arm64-tcl9\tkdnd_windows.tcl
        • Size 7KB
        • SHA256 991f878a7a45c83cb5403ad82a768211b12640bf2b8b0cbceb8385b293d10809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\pkgIndex.tcl
        • Size 2KB
        • SHA256 b0b941a237080368ca70b5ffe2b7752978da474a171f0a6303255bddc8a26834
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tkdnd.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd.tcl
        • Size 19KB
        • SHA256 0d857154d6a11a0a94a6ea7c480172fe81a3d6538acb821260fdc38f48b8ba44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_compat.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd_compat.tcl
        • Size 6KB
        • SHA256 87ce43002f60fb7c22c8ca6c17ed13151d21e48175048254c448ac774937b580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_generic.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd_generic.tcl
        • Size 25KB
        • SHA256 78a606df6864e72f1ff19aacbcee2c2559983f1a2aacad5cf21cce51ba7ec5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_macosx.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd_macosx.tcl
        • Size 6KB
        • SHA256 a102102f7fc23f8c401efad0c2877f1654b74365d11c3512721a79119b1071c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_unix.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd_unix.tcl
        • Size 37KB
        • SHA256 e6e7c64069d975183717d0bfa0931d99403c2d56760cc18230b80712f8a52c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_utils.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd_utils.tcl
        • Size 10KB
        • SHA256 5269a7682f3a9c4a78410844d614277b21e63ac69cd30d18d666ddc7191c74c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tkdnd_windows.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\tkinterdnd2\tkdnd\win-x86\tkdnd_windows.tcl
        • Size 7KB
        • SHA256 5774188ca4b626a8ba243e860b04b198c12bbb61efa1896bfcf4eddc07399fe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30682\unicodedata.pyd
        • Size 1.1MB
        • SHA256 c3e10e814e4e36b5f6f66231ccbb80edd6fd219994406b383ecfa44d57efc537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5008-1349-0x00007FFD88EC0000-0x00007FFD890D6000-memory.dmp
        Download

        memory/5008-1353-0x00007FFD88B10000-0x00007FFD88C00000-memory.dmp
        Download

        memory/5008-1352-0x00007FFD88C00000-0x00007FFD88E90000-memory.dmp
        Download

        memory/5008-1351-0x00007FFD88E90000-0x00007FFD88EBB000-memory.dmp
        Download

        memory/5008-1354-0x0000021AD0200000-0x0000021AD179D000-memory.dmp
        Download

        memory/5008-1350-0x00007FFD8CCA0000-0x00007FFD8CCB6000-memory.dmp
        Download