Overview

overview

9

Static

static

3

poc_ransom.exe

windows10-2004-x64

9

poc_ransom.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 22:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    poc_ransom.exe
  • Size 15.0MB
  • Sample260811-2qq2hstdna
  • SHA256 6779ac3170b2a42eba5207afe3d5da7028c8cb5deb4811a7aeae82db07e8fb16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (148) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Loads dropped DLL 46 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 22 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\poc_ransom.exe
    "C:\Users\Admin\AppData\Local\Temp\poc_ransom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\poc_ransom.exe
      "C:\Users\Admin\AppData\Local\Temp\poc_ransom.exe"
      2⤵
      • Loads dropped DLL
      • Drops desktop.ini file(s)
      • Suspicious use of WriteProcessMemory
      PID:3200
      • C:\Users\Admin\AppData\Local\Temp\poc_ransom.exe
        C:\Users\Admin\AppData\Local\Temp\poc_ransom.exe --lock-child
        3⤵
        • Loads dropped DLL
        PID:6000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Cipher\_Salsa20.pyd
        • Size 13KB
        • SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Cipher\_raw_cbc.pyd
        • Size 11KB
        • SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Hash\_BLAKE2s.pyd
        • Size 13KB
        • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Hash\_SHA1.pyd
        • Size 17KB
        • SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Hash\_SHA256.pyd
        • Size 21KB
        • SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _scrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Protocol\_scrypt.pyd
        • Size 12KB
        • SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\Crypto\Util\_strxor.pyd
        • Size 10KB
        • SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_bz2.pyd
        • Size 84KB
        • SHA256 0ec5bdf4c688c1d2bda00f61e1f9e1369188c1019173a5412981f6569a997347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_ctypes.pyd
        • Size 124KB
        • SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_hashlib.pyd
        • Size 65KB
        • SHA256 dfacbb48ade3d53780ff1e6875da90930a4a5d593e21984779079bd6f98f3768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_lzma.pyd
        • Size 156KB
        • SHA256 ed997ca4956fe7e27cc702adaa8d31136312361d285b7b845c8829d8c5a89ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_queue.pyd
        • Size 32KB
        • SHA256 eb4070d87384565985a59a7139e0903b120044059cb0934a9a425c360e93a34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_socket.pyd
        • Size 83KB
        • SHA256 961dc7c65a28c174688e2f6b7803a615b9c034849a17cfc6527a27ccb2eeadb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_ssl.pyd
        • Size 174KB
        • SHA256 78728b5e06037e3adfe922b59bb1dd19dea391e9ca02e21caab3cdc832111036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\_wmi.pyd
        • Size 38KB
        • SHA256 4f6361517b4e127642d4e641ddbfa060b3d32da8ac7fc7a35a51c02680933084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\base_library.zip
        • Size 1.3MB
        • SHA256 32d6ffdf27eb8758d44425fceaf733b8101032cfee35da57c8a2210e0ef51173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\python312.dll
        • Size 6.6MB
        • SHA256 b6227a506a9963e7c8182785a54e14a193af51f7b277a61dda04492b499f49ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\select.pyd
        • Size 32KB
        • SHA256 e6bff4f35ab49a84f9e5ccd4b26eff30e1b2d7adb67d91911c4b84bfabcc28b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45722\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/6000-1405-0x00007FFC75270000-0x00007FFC75299000-memory.dmp
        Download