Overview

overview

7

Static

static

3

diddyp.exe

windows10-2004-x64

7

diddyp.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 10:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    diddyp.exe
  • Size 4.0MB
  • Sample260815-m3c8vsan2y
  • SHA256 45c1e0bc5ecd48077224d8db858c72e9f1eba774fbd3461117f4887ef5fe8c63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\diddyp.exe
    "C:\Users\Admin\AppData\Local\Temp\diddyp.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Users\Admin\AppData\Local\Temp\diddyp.exe
      C:\Users\Admin\AppData\Local\Temp\diddyp.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /k "title Hi & cd /d \"C:\Users\Admin\AppData\Local\Temp\" & \"C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\python.exe\" \"C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\diddyp.py\" --hi"
        3⤵
        • Executes a command shell one-liner
        PID:4320

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\VCRUNTIME140.dll
        • Size 97KB
        • SHA256 1a130e77ef1995a593e7e621fa384c8404dcfa90ba705fb12ac8ad47b2812edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\_bz2.pyd
        • Size 71KB
        • SHA256 d09ad848cf0cb4f44861f4aa00aae5d3b65730b3691a288239243d9bd25ae271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\_ctypes.pyd
        • Size 113KB
        • SHA256 b84e3a6adf05705ffb90378d645901a41898e1b2a8a8204be33cbf4c25f9ea7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\_lzma.pyd
        • Size 144KB
        • SHA256 65d0e0fae603c74055ad05db9c7c80a9973d797410e0f8f9a9b597dad1024042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        diddyp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\diddyp.dll
        • Size 4.7MB
        • SHA256 239064179346cf10bae16693842c6328085fd645b698600368ab6aaa9a4a4e62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\libffi-8.dll
        • Size 27KB
        • SHA256 f6a7d8221d02a990f752b88372e2937767fcd479322d6350fcc8314490aeb4bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2968_728523_-bA1U9stoQI\python312.dll
        • Size 6.6MB
        • SHA256 e4b418a8724e1d76cdb4de35d6cbf99aab2455f4720e72f6b353ce0e48ea065f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download