Analysis
- geolocation tags
- user interaction
yes - max time kernel
299s - max time network
271s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 17:39
General
- Target python-3.13.13-embed-amd64/pythonw.exe
- Size 101KB
- Sample260813-v8chhscc86
- SHA256 e98f517f1fa209c691c57d058e538473c4dedcecacd2e466c3f2bce54fc431f4
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\python-3.13.13-embed-amd64\pythonw.exeC:\Users\Admin\AppData\Local\Temp\python-3.13.13-embed-amd64\pythonw.exe .\config.py1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\python-3.13.13-embed-amd64\python.exe"C:\Users\Admin\AppData\Local\Temp\python-3.13.13-embed-amd64\python.exe" .\config.py2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ft3ieqkr.npl.ps1
loader.log
loader.log
loader.log
loader.log
loader.log
loader.log
poly_diag.log
poly_diag.log
poly_diag.log
poly_diag.log
memory/2448-60-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-52-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-48-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-46-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-42-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-40-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-44-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-50-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-56-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-58-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-62-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-64-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-54-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-0-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-21-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/2448-17-0x000001AB7CE50000-0x000001AB7D035000-memory.dmp
memory/3040-238-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-189-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-216-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-218-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-220-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-222-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-224-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-226-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-228-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-230-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-232-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-234-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-236-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-214-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-192-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3040-171-0x0000024A47CB0000-0x0000024A47E95000-memory.dmp
memory/3804-161-0x000001E470160000-0x000001E47016A000-memory.dmp
memory/3804-158-0x000001E470170000-0x000001E47018A000-memory.dmp
memory/3804-169-0x000001E456190000-0x000001E4561A0000-memory.dmp
memory/3804-139-0x000001E46FB90000-0x000001E46FBAE000-memory.dmp
memory/3804-168-0x00007FF42ACD0000-0x00007FF42ACE0000-memory.dmp
memory/3804-137-0x000001E46FBD0000-0x000001E46FC46000-memory.dmp
memory/3804-165-0x000001E456190000-0x000001E4561A0000-memory.dmp
memory/3804-166-0x000001E456190000-0x000001E4561A0000-memory.dmp
memory/3804-149-0x000001E46FBB0000-0x000001E46FBCC000-memory.dmp
memory/3804-160-0x000001E470150000-0x000001E470156000-memory.dmp
memory/3804-159-0x000001E46FD20000-0x000001E46FD28000-memory.dmp
memory/3804-140-0x00007FF42ACD0000-0x00007FF42ACE0000-memory.dmp
memory/3804-157-0x000001E46FD10000-0x000001E46FD1A000-memory.dmp
memory/3804-156-0x000001E46FD30000-0x000001E46FD4C000-memory.dmp
memory/3804-141-0x000001E456190000-0x000001E4561A0000-memory.dmp
memory/3804-151-0x000001E46FAF0000-0x000001E46FAFA000-memory.dmp
memory/3804-150-0x000001E46FC50000-0x000001E46FD05000-memory.dmp
memory/3804-136-0x000001E46FB00000-0x000001E46FB44000-memory.dmp
memory/3804-135-0x000001E46F590000-0x000001E46F5B2000-memory.dmp
memory/3804-127-0x000001E456190000-0x000001E4561A0000-memory.dmp
memory/3804-126-0x000001E456190000-0x000001E4561A0000-memory.dmp