Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 03:11

General

  • Target
    Epic games stealer.exe
  • Size 13.2MB
  • Sample260809-dpm2gayhla
  • SHA256 8cd749b307dabde1a1a7389d0eeb7d9c67c1b3fdad989673707345fc2703da9a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Epic games stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\Epic games stealer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python.exe
      "C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python.exe" "C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\app/Epic games stealer.py"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1660

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Epic games stealer.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\app\Epic games stealer.py
        • Size 2KB
        • SHA256 f8a64129645662602e1f14bad957843b8d221d81d7c40f9d2477f169401185a9
        • MD5 SHA1 SHA512 TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_bz2.pyd
        • Size 85KB
        • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _hashlib.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_hashlib.pyd
        • Size 67KB
        • SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_lzma.pyd
        • Size 157KB
        • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _queue.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_queue.pyd
        • Size 35KB
        • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_socket.pyd
        • Size 85KB
        • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ssl.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_ssl.pyd
        • Size 186KB
        • SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _zstd.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\_zstd.pyd
        • Size 491KB
        • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-3.dll

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\libcrypto-3.dll
        • Size 6.0MB
        • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-3.dll

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\libssl-3.dll
        • Size 1.3MB
        • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python.exe

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python.exe
        • Size 103KB
        • SHA256 03168c01b7b7491423350e82c26fee71f35b43694d1319d3c668bda6903a0c38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.DLL

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python3.DLL
        • Size 72KB
        • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314._pth

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python314._pth
        • Size 52B
        • SHA256 15bbad333b1bc4d3e8bcfc361c3447ab1d28ceaac02e660b2f439ca546ce418e
        • MD5 SHA1 SHA512 TLSH

        python314.dll

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python314.dll
        • Size 6.5MB
        • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314.zip

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\python314.zip
        • Size 3.9MB
        • SHA256 e13e610c2e56173cc933986f38c56c7439e4e1519ddf98829e92c5d348f1c376
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\python\select.pyd
        • Size 32KB
        • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\charset_normalizer\__init__.py
        • Size 1KB
        • SHA256 d0d4fc3078bb48aab78ee32a61f39dae4ce38ac2b42fbde59de3471f8a9a500b
        • MD5 SHA1 SHA512 TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\requests\__init__.py
        • Size 5KB
        • SHA256 311157e7fa4aa9166c827d5237e6fd694eeb5ca549ee40e2e90f89f21abcd56e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        compat.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\requests\compat.py
        • Size 2KB
        • SHA256 5d79ba289690b5015044341a1f7bc7d24134fc13a2db3efcf852515bf9aa18b4
        • MD5 SHA1 SHA512 TLSH

        exceptions.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\requests\exceptions.py
        • Size 4KB
        • SHA256 c5e18f3352454968e337bb3056f0867df2f37c0a0d2c1a77dc05e7e0b3c0411b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\__init__.py
        • Size 6KB
        • SHA256 24ca35b60d67215d40789daf10d0bf4f17e5d1ee61e86ce5f43195935ad645ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _base_connection.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\_base_connection.py
        • Size 5KB
        • SHA256 1f37121077b1803ad152beb48cd9e20762908ddc3ded279d0f996e45f1ed0978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _collections.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\_collections.py
        • Size 17KB
        • SHA256 68e566da62a296fbaf4f579f006b6403ba62eb90b5342dc725fa45c6f6014bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _request_methods.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\_request_methods.py
        • Size 9KB
        • SHA256 802785f3948efd45385a83f0607228cffb70f9e33f1153a42c5a7c385b02ec30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _version.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\_version.py
        • Size 520B
        • SHA256 fa032b2a1b0f88e8f45f351ecd515ae7d7754ba4204222a0413e601a0c8cf3ec
        • MD5 SHA1 SHA512 TLSH

        connection.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\connection.py
        • Size 41KB
        • SHA256 668b37ab12835bdf8643a695a9f050551339b280742231f163fc575a925a1532
        • MD5 SHA1 SHA512 SSDEEP TLSH

        connectionpool.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\connectionpool.py
        • Size 43KB
        • SHA256 b0616775d5d8c25c7b282e0908fd602af74d18b34af984c22437460021a3dd8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exceptions.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\exceptions.py
        • Size 9KB
        • SHA256 8503c7a2aa38cb0e3a7ac3525647225505d5520031580825b21e8c6f242d6be4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fields.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\fields.py
        • Size 10KB
        • SHA256 6862c5015669554f856c996596f7b8021834fa91fd659050d88cfb95fa648e43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        filepost.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\filepost.py
        • Size 2KB
        • SHA256 53c78d67e9a928a1e1ae56c7104893c7180ad7a21e8e111aeeecf8db2a80fdd2
        • MD5 SHA1 SHA512 TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\http2\__init__.py
        • Size 1KB
        • SHA256 c73ac0487ed1e4035190f24ea2de651a70133aadca2aec97cc8e36adc9f09aab
        • MD5 SHA1 SHA512 TLSH

        probe.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\http2\probe.py
        • Size 2KB
        • SHA256 9e7024a9b8406a43a217be6bcfb5b4b9d677f047a1fee0fc7e357be0def71442
        • MD5 SHA1 SHA512 TLSH

        poolmanager.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\poolmanager.py
        • Size 23KB
        • SHA256 734ae1d2b7140b5b79b431ae51e188800ce512b6ac3cec16c0b881ebb957f293
        • MD5 SHA1 SHA512 SSDEEP TLSH

        response.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\response.py
        • Size 51KB
        • SHA256 f525f806491da0b82cc759deea1a6dfb93e772b9c3ccfcdea82d4369285273e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\__init__.py
        • Size 1001B
        • SHA256 faa792d1071e8af6b3bc110a0cd142008fba00271d0ce1384ccbe8ed22cd9404
        • MD5 SHA1 SHA512 TLSH

        connection.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\connection.py
        • Size 4KB
        • SHA256 2633bbdb69731e5ccb5cf4e4afd65605d86c7979cc5633126f50c92d5ad74a74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        proxy.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\proxy.py
        • Size 1KB
        • SHA256 b1e3fcf90e41e9b07474cb703e3f98719650df4bc7b8ba91bbeb48d096767f3b
        • MD5 SHA1 SHA512 TLSH

        request.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\request.py
        • Size 8KB
        • SHA256 8ada670bcba0ec3e2755f0e6194091325824011510d77aff5ccc529f34f09a91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        response.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\response.py
        • Size 3KB
        • SHA256 bd013adfdba81218f5be98c4771bb994d22124249466477ba6a965508d0164e0
        • MD5 SHA1 SHA512 TLSH

        retry.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\retry.py
        • Size 19KB
        • SHA256 d989d25fefc579c312843eb5331e6cebc274fdbb541d9aeb73f064155452d4fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssl_.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\ssl_.py
        • Size 17KB
        • SHA256 3aa7b7ac88545377b7195819a1bda1c6647c43464386b84448f94f3ff18b6954
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssl_match_hostname.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\ssl_match_hostname.py
        • Size 5KB
        • SHA256 16de38289cd3cc632629f7ff6573fdd658b65785a19af132d7a3ca05cbf8bd99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssltransport.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\ssltransport.py
        • Size 8KB
        • SHA256 133e0ef2947fbd3f1d6a7fc5bea0584ba7600df05710c7d57ebcdc754a167e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        timeout.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\timeout.py
        • Size 10KB
        • SHA256 e1e4f5155799654ee1ee6603d49ab639735ee1fc5e91d36f868594919bac4690
        • MD5 SHA1 SHA512 SSDEEP TLSH

        url.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\url.py
        • Size 14KB
        • SHA256 59187e4cc617a2c9a0a7c9bc953e07e6ca681f0e7252395c3027d4e77024a00b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        util.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\util.py
        • Size 1KB
        • SHA256 8f795b64ad633f28b00f7e13f08809cdd5846554fee04fb4bd82098bd52378d0
        • MD5 SHA1 SHA512 TLSH

        wait.py

        • Path C:\Users\Admin\AppData\Local\runcell-pyexe\36dd8952ad1657323075a8639f9b9d66\site-packages\urllib3\util\wait.py
        • Size 4KB
        • SHA256 fe987c22b511deca8faa2d0ea29420254947e30ce419e3390a2c80ed7186b662
        • MD5 SHA1 SHA512 SSDEEP TLSH