Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 15:35
Behavioral task
behavioral1
Sample
MythosR4T.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
MythosR4T.exe
Resource
win11ltsc2024-20260710-en
2 signatures
150 seconds
General
- Target MythosR4T.exe
- Size 75.1MB
- Sample260817-s1mbmstdne
- SHA256 a031ea718a07308f6501068db3d69e680d151d4a3cbcc5c460efdac272e8138d
- MD5 d5af0c86dff831864d0cd158653c22bd
- SHA1 57a1fa00eca0d7bce23ad40c52afa2609f135400
- SHA512 9474b3af3e7e283a0bfbb053aef2cb23f8873652998186b57db5b3258f954343e391498b3f0009b96de67059ae49d6faf92c842bd8738c6025da962cfbaa317e
- SSDEEP 1572864:A4dEK/OBgOiUaCTF9KBOJo4rVyLVmKOIF/hOMJ5qlS39efi4F2l+paDOHrV:h2bgOiATFgBOCqyou0MJv9cX0ApayZ
- TLSH T1690833142600B8CBEDAAC3398794CF099964689C5663CC1EB27454372EE33FF7DB5A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 12 IoCs
pid Process 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe 708 MythosR4T.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4260 wrote to memory of 708 4260 MythosR4T.exe 89
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Temp\_MEI42602\VCRUNTIME140.dll
- Size 86KB
- SHA256 2100196b81e2c056aad70403e312393d1e3455c57893049e7e244b6efb09bdb3
- MD5 39ac97832408d50036ed5727ec08dd68
- SHA1 e5b69e4aef019af619414d6a26a7861dc1db3e2d
- SHA512 eb6d273eef85f1c00a7516c14a9d86f206415a8397feb9d50ddc684d73861a3fa78edda407fe6993e46f2fb654ce68babc12b3caae4f036f5b236323227e638b
- SSDEEP 1536:KHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJN:KrfZ+jPYNzoHA4decbK/FN
- TLSH T194835B5A76A442BBD06BC278C5E30A1AE371B8048B7053CF07B5466A9F27BF15E3D352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\_bz2.pyd
- Size 70KB
- SHA256 414b09558b917bf65053ae5cd73177a04c80ce528f4ecb2a4ab187addce7a097
- MD5 30355d49bc0fd240bf13989aa4692607
- SHA1 b632d5ec134c03cf56d3ce6ce90e582ef52136c1
- SHA512 4c71eb50daad838e8a0e1e9d553fec90266e64b25ab13f2cd5c72e3881da51056e22a69c6a219c059b07b4815a85c1432f189e27fe705b4e67aecee769699a3f
- SSDEEP 1536:+XOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCV:OOzwpyAFi7WMgW34jZm35ILCV
- TLSH T1FC637B92B3A591F5F05BB27986710357E371B90D03A093AFB794826F2F13F916C6432A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\_ctypes.pyd
- Size 109KB
- SHA256 78c5de582963eaa9143ea434e0daebd0e258b90859a246b87dedb51628fcf0c7
- MD5 572dcf5a3d8765dfbcfa4d3919749a12
- SHA1 8a70c3314d7c08c9eab538a340379f609aec9d4e
- SHA512 1974951621e343ffce31082d518105bcc17b7cc56f34117d2a0074731093febc7b16a2415baffd3d84c1db8092e4066110908160540d6ff2d6a0f409d7f483bb
- SSDEEP 1536:GormdLFuESRiainHJcdIyFqKs1FdhvDmPA9MeERfhBIbEi0s2UtdL8VILLP:ZOEESRiaiH6lU1vxqfrId0sx3gVILLP
- TLSH T1BBB33B0B235800AAEB67507CC5735E47DB71B859171087CF0294CA9E2F67BA75E7EB02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\_lzma.pyd
- Size 143KB
- SHA256 b6f386aef6eee5ccdbb1268c91939b44cacab742f134911591a2702e1ac5ddca
- MD5 d171fcedc425a4288d0e60f59bb4bd1f
- SHA1 b37c3536a7adb553d092cdf8c8fca3397d0275dc
- SHA512 b338bff873c560f9317d563b1490040ac614b4631ee65b9a41929709e48698369bc9313ba8a72ce6d63ed8e58babdc0f2c42677c35d96157faadc5ff84eb43ec
- SSDEEP 3072:w0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1:w0kiXjD9v8X7Euk4wYOFTafx
- TLSH T176E32882B394F0E6F3628C78D6224F57D6F578190320929A02CC976D2B1FB759E2E717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\_socket.pyd
- Size 65KB
- SHA256 99eb75336cda64ac448265c362c9602ed982329b20e2c3270ad44b5bce801768
- MD5 582f0893b6caada482ae2a6495318130
- SHA1 14d5c86935e6a3f63f728b4945255a0f59fbce9b
- SHA512 10912311ada608b8a4ab8077c63c02d8b0999ff163335f5fd62f8618fde596b069de108d6281b8ea63d9407830634e52f0ea9309dddc2bdeb7c169912f63b1ee
- SSDEEP 1536:fmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLw:e56OzyAs9/sT+pGLypb+k/XFVILLw
- TLSH T10A633A11A29051B9D2B3807AC5635F63F7B4F4901395A78F1660DA6E1F337829E3AFC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\base_library.zip
- Size 1.0MB
- SHA256 e692723bee99f8e46fbf80099e9e5de7994f53d3bdd7cb79cce191e027ec8ebc
- MD5 94a161d27174dd43731d82a6daf647b9
- SHA1 55fb642ad43695fcb422e954349e622603d055b7
- SHA512 9b0fa46e8b4ed8a6ca3e04e4422fee11c9093ac507c68892cdd677ec1b7114dbe5084b75fe072adf30c6d266c00d396ef829f8c87ccfee0cac3e8ce6f5e7960c
- SSDEEP 12288:cgYJu4KXWyBC6S4IE/8A4a2YWw3dOVwx/fpEWer/3u+E0SLMN8:cgYJiVB+La2VzVwx/fpEWe7u+E/MN8
- TLSH T1E0354A8079921ED7FE05F278815B8A3C469AB339DB89D543B94FC2D87F072E40D61A9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\libffi-7.dll
- Size 25KB
- SHA256 687a88229f6f2f2be875d31efeedda7e719e8a1066b03f5c0f63b83829549d63
- MD5 dcfecfdfdebc49d1e08cd1c3afb1ba9d
- SHA1 90bd70de6ca5816d56c62ad18b0e28a6172d5636
- SHA512 ef8351e1acac38fc722dd4d61ed2e66fb4a8cbe28af6ec588165ff86888b0fe0525882917f6de8ee6bbae74b8a66a3d4e6b8330e91571e1bc87955f99e21243f
- SSDEEP 384:i/HypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAw:gF0Vn5Q28J8qsqMttktDx
- TLSH T1C1C2180B668455F4E667D03A87379E59C23A39341351A7CB02E096BB2F2B7E4E73D305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\pyexpat.pyd
- Size 182KB
- SHA256 00b7b6391096044795c22f4dcf3a61c845eca9cfec29513da41935e65a73bce8
- MD5 7c5fa61abed2e0f877f9f7270e68eb2e
- SHA1 ee93a15363964ab8b9dc5652b23075b197e31be9
- SHA512 08f9b92161c1beef133f647f5c443980a1b134257811d6f06660bdad605469f03d3efb7d2544168e6816dd15b1fc58a1463dddfcbc48b489ce306b5bf7dcd48d
- SSDEEP 3072:6BAJzkk5dT6F62eqf2A3zVnjIHdAPKReewMP12yGUfT0+SYyWgOmrpjAxvwnVIL9:6Qg4dT6N5OA3zVnjNed4yGKTKR
- TLSH T199045C5B71A6C0EBE8938038D6D78B07DB71B8A5039097CF1284EB7D5F27B513A29315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\python3.DLL
- Size 52KB
- SHA256 52f1821ea53dff992ce24f1dfa71481db2eaf58dacaa7d5a0caacbeacaee019f
- MD5 10b9d06b9508bbcf28cec2726030c388
- SHA1 30ede66d5910e2ae34b30c4144402465ee977d78
- SHA512 9c350a35ed65b004c59415c8d9b45549e9f926ecac439a1eae43942552a0a54c399e022398ab7efca581d1d2028affaf1c526f497015078e494871787b286755
- SSDEEP 768:zM8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqG:zMwewnvtjnsfwxVILL0
- TLSH T1D4331B526B58FDA2D6FAA5FC38D199CD542B02CC972984DCB47893D30E1A320A127F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\python310.dll
- Size 4.2MB
- SHA256 05e63d898372ff31ef7063e4f0d5d16c4f0e2b6ab732e505b838d209992de111
- MD5 e540e3130cdd57e98c2e09ed19ee87bd
- SHA1 81454faac9e0b3eef96d9d7a6999431c262f424d
- SHA512 d3fa6626f23043c1db68da40ff8aab4b8fe143acee2b47d5c474ed34ea3f30b585e3be8e404c0c4312ca7601b624a17ce730b31a030a6374604705439ac2e6b2
- SSDEEP 49152:7yrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbHg:lw5tVBlicWdvoDkHUMF7Ph/q
- TLSH T1A8267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Africa\Conakry
- Size 148B
- SHA256 d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
- MD5 09a9397080948b96d97819d636775e33
- SHA1 5cc9b028b5bd2222200e20091a18868ea62c4f18
- SHA512 2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799
- TLSH T17DC0028957180543C410B3F44DC311E8DF15C00DD532537330186708C4665D51A14945
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Africa\Djibouti
- Size 265B
- SHA256 c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
- MD5 86dcc322e421bc8bdd14925e9d61cd6c
- SHA1 289d1fb5a419107bc1d23a84a9e06ad3f9ee8403
- SHA512 d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b
- TLSH T187D0C9885E25E190F0C25834DFF2450BAE5687FC93334CBAB45C586053748546ADE4E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Africa\Kigali
- Size 149B
- SHA256 93f19e9551d58868ae5820752d2c93a486124c364463dc9c9489d0458f8bc682
- MD5 b77fb20b4917d76b65c3450a7117023c
- SHA1 b99f3115100292d9884a22ed9aef9a9c43b31ccd
- SHA512 a088c2a4c7d72717257c3125c7c2aca28463d68306ea452afaad75b8a0f9e5730a8d9c430d14668809717a672dc63c4816762acb046b339da662da421a6d65df
- TLSH T1CAC00245D61F4D67E95097F41F6703019C5B8740CE51717F64D9145CCD541E49F40144
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Africa\Lagos
- Size 235B
- SHA256 cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
- MD5 8244c4cc8508425b6612fa24df71e603
- SHA1 30ba925b4670235915dddfa1dd824dd9d7295eac
- SHA512 560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c
- TLSH T1C5D080C513B00097CA10773C1FE334D1D5150564456E25EB10540CC411250D273FFCE8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\America\Curacao
- Size 246B
- SHA256 8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
- MD5 adf95d436701b9774205f9315ec6e4a4
- SHA1 fcf8be5296496a5dd3a7a97ed331b0bb5c861450
- SHA512 f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348
- TLSH T130D0120ABB5185A8E2A273B107F303C7899CC1444C20EA2EE607326224A48B03AB4C80
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\America\Toronto
- Size 3KB
- SHA256 820392cdb1e499f82ef704d0ccfd0c50ab2b28c6e0bdeb80793861d5e165d5ad
- MD5 44a2dd3cb61b90aa4201c38e571a15ba
- SHA1 73f6ad91b2c748957bdaec149db3b1b6b0d8ac86
- SHA512 11ddb971c65c2f4ecc690ef685163f2972c089660f4778997964d89113a403030927edbb2ed397b81cf61bde9276add6a43ee8ee92dfa69a6d102b035fe9f01d
- TLSH T11F71F5A8AD4D70EFDF0112BE0462C03DCB806153832757CAEB8807402678F6EC999FA7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Etc\Greenwich
- Size 114B
- SHA256 6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
- MD5 9cd2aef183c064f630dfcf6018551374
- SHA1 2a8483df5c2809f1dfe0c595102c474874338379
- SHA512 dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Europe\London
- Size 3KB
- SHA256 c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
- MD5 a40006ee580ef0a4b6a7b925fee2e11f
- SHA1 1beba7108ea93c7111dabc9d7f4e4bfdea383992
- SHA512 316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e
- TLSH T1AD71D8C75455851DC0EC2A7B7CB3424A5A44568D83BE4262F4EEA3C8D2FB7D45E1D9C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Europe\Oslo
- Size 2KB
- SHA256 5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
- MD5 7db6c3e5031eaf69e6d1e5583ab2e870
- SHA1 918341ad71f9d3acd28997326e42d5b00fba41e0
- SHA512 688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe
- TLSH T1C241845104628756D14C38F259717CCB0B1D2A59087C6BAF39AAA34527F4DD83F193D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Europe\Skopje
- Size 1KB
- SHA256 3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
- MD5 6213fc0a706f93af6ff6a831fecbc095
- SHA1 961a2223fd1573ab344930109fbd905336175c5f
- SHA512 8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327
- TLSH T18E419591043007D6E10C19F38872688F4A61564DAF5F4F6B1C967A4D16BC5E45F0E2B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\PRC
- Size 561B
- SHA256 64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
- MD5 09dd479d2f22832ce98c27c4db7ab97c
- SHA1 79360e38e040eaa15b6e880296c1d1531f537b6f
- SHA512 f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200
- TLSH T115F05C4C50A84EC7C37CB7F9365B94968B40A5C38F13159F11465A0DA03AFF508181F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Pacific\Wallis
- Size 152B
- SHA256 53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7
- MD5 5bdd7374e21e3df324a5b3d178179715
- SHA1 244ed7d52bc39d915e1f860727ecfe3f4b1ae121
- SHA512 9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383
- TLSH T169C002C0B71818D3C415577D059B17545D57D5414D035777328A14CDED9479157188D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\Pacific\Yap
- Size 172B
- SHA256 9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0
- MD5 ec972f59902432836f93737f75c5116f
- SHA1 331542d6faf6ab15ffd364d57fbaa62629b52b94
- SHA512 e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d
- TLSH T10EC0928152BB0C0BC63012B40A8B47A3ED99954191062BEB210803D9F0B9B8126014CB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\_MEI42602\pytz\zoneinfo\UCT
- Size 114B
- SHA256 8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
- MD5 38bb24ba4d742dd6f50c1cba29cd966a
- SHA1 d0b8991654116e9395714102c41d858c1454b3bd
- SHA512 194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\_MEI42602\select.pyd
- Size 17KB
- SHA256 e4e0542f20a63348219b8e5e39271f8913981dcff1f51be92202a456e80832b1
- MD5 80cbae0f1cfc38fc6d771614ef7a2554
- SHA1 84578c6f735909505d48b0c341bb6ef73de1f639
- SHA512 715f1dd7d3b82a127f48cebb0bb874490359ce17ace181c5fd5ae5dae9f0ef43efe700707e0b9df37b04bf16c5881a4a55a5bf1c05e6e1976a47b605d1414463
- SSDEEP 192:gxPQeHHtS60PcyDDa12hwheCRgOU5fNXLKbBC7XXwcqiMpvILQG:gxPjk/7e12hwheCRHqNsBMX0nVILQG
- TLSH T1E4824B49BB9498D2E1738172C9678F02E935BA71472583DF33A5826D2F33B817237B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\_MEI42602\ucrtbase.dll
- Size 1.3MB
- SHA256 eb50b27100664004f019f7c5b41a7caa0a6b7d345f15d24ac3780709ff6bb90b
- MD5 d9d93153c89c69cd455e3bae63aa3494
- SHA1 01928838fb9ad469e85a662c81f17c9db1c27c19
- SHA512 2485ae021ef28b699ef224d3b12cae4c7afc89d9194d465ac34ce4b03ec2b31ac7a6ae5520c86abf1d56b5bff602ce2a34b585ff710a2462befafed6164ae4f7
- SSDEEP 24576:KQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPn:KQWhXCFm7Cw3w3ZXX6DYaY9lpU
- TLSH T1D055AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH