Overview

overview

7

Static

static

3

windows.exe

windows10-2004-x64

7

windows.exe

windows11-ltsc_2024-x64

7

Resubmissions

19/08/2026, 17:25

260819-vzh9ps1ygs8

19/08/2026, 15:43

260819-s511laxdqe7

Analysis

  • max time kernel
    30s
  • max time network
    37s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 15:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    windows.exe
  • Size 78.4MB
  • Sample260819-s511laxdqe
  • SHA256 827146a5e4b846f7cbd992b88cf4f2f609d8fe1ee7caa87d33023dea1138073a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windows.exe
    "C:\Users\Admin\AppData\Local\Temp\windows.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5192
    • C:\Users\Admin\AppData\Local\Temp\windows.exe
      "C:\Users\Admin\AppData\Local\Temp\windows.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\svshost.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Windows\System32\svshost.exe
          C:\Windows\System32\svshost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:612
          • C:\Windows\System32\svshost.exe
            C:\Windows\System32\svshost.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:2952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_asyncio.pyd
        • Size 69KB
        • SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_bz2.pyd
        • Size 83KB
        • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_ctypes.pyd
        • Size 122KB
        • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_hashlib.pyd
        • Size 64KB
        • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_lzma.pyd
        • Size 156KB
        • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_overlapped.pyd
        • Size 54KB
        • SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_queue.pyd
        • Size 31KB
        • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_socket.pyd
        • Size 81KB
        • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_sqlite3.pyd
        • Size 122KB
        • SHA256 fdeacc2aff71fe21d7a0de0603388299fa203c2692fdbdb3709f1bc4cc9cdc0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_ssl.pyd
        • Size 174KB
        • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_wmi.pyd
        • Size 36KB
        • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
        • Size 222KB
        • SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\base_library.zip
        • Size 1.3MB
        • SHA256 1c208031a9ab259a210e7a459d0e27fd7c396e87db4c4a31dbd0035fbf9f905c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\charset_normalizer\cd.cp312-win_amd64.pyd
        • Size 10KB
        • SHA256 be1d8801c9785a52e5bc1b0c77ceca2c88041a5d9b9bac7162d767f712ea10e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\python3.DLL
        • Size 66KB
        • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\python312.dll
        • Size 6.6MB
        • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\pywin32_system32\pythoncom312.dll
        • Size 674KB
        • SHA256 18e5d69b62110f48da01842f9ddfd99d06cc561f0866371714ec6534fcb4e5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\pywin32_system32\pywintypes312.dll
        • Size 133KB
        • SHA256 9bd7f8c39a84d7b1ea43bfcd33c04631c60f4ff28167e82bb21987cc1c353766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\select.pyd
        • Size 30KB
        • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\sqlite3.dll
        • Size 1.5MB
        • SHA256 054a7b736de7afbd447b07ee5e72df2febcaa06758f7a028873771567e8735d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\win32\win32api.pyd
        • Size 135KB
        • SHA256 8e09d7aa57dc33b663afd219fab21b6a70e9d98cc74a044df4d6cd94799d98c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\win32\win32crypt.pyd
        • Size 123KB
        • SHA256 30cf71545212bbfb7362618f41a40cefcea39327306fdd7926c95374ce9294bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\win32\win32event.pyd
        • Size 29KB
        • SHA256 a6b896456443447a663fe25783dfa95929dc8ade8d7970fd78d3b4e65100371e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\win32\win32gui.pyd
        • Size 218KB
        • SHA256 f468a03be44633fdeabc08b4a9f8b135f9e31d74b935f85631c23c7fbb9367fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32net.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\win32\win32net.pyd
        • Size 92KB
        • SHA256 1711a1fae657bddbb494566bc79781dec85d63d38cb38fc9a1121b9d341dd495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32process.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\win32\win32process.pyd
        • Size 52KB
        • SHA256 6d02ff9b22afa97bdb26d99454462a612848efdc3d0beb54cea2b4912d07a14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winsound.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\winsound.pyd
        • Size 29KB
        • SHA256 0c780495a45af34e7553c71705c677ff7ee8b0ea29cda077c1696ac83986fc4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download