Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 12:57

General

  • Target
    Rec Room Tools!.exe
  • Size 32.3MB
  • Sample260821-p6wwgseq2x
  • SHA256 9532fb7df31ecb3038d426aa9610fda64cc259048fe4991824473b1f2519eca9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 45 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rec Room Tools!.exe
    "C:\Users\Admin\AppData\Local\Temp\Rec Room Tools!.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3332
    • C:\Users\Admin\AppData\Local\Temp\Rec Room Tools!.exe
      "C:\Users\Admin\AppData\Local\Temp\Rec Room Tools!.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:5564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\MSVCP140.dll
        • Size 562KB
        • SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\VCRUNTIME140.dll
        • Size 91KB
        • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_bz2.pyd
        • Size 85KB
        • SHA256 97966e8d9098cb8f92228da99c5a3ce1a768f7fcc464a1da1bfc8c34f8784c51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_ctypes.pyd
        • Size 123KB
        • SHA256 53ab0a3ca27a793171a830012c686fc868e974733853667419881ac712b48371
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_lzma.pyd
        • Size 159KB
        • SHA256 4a1a02175258ce809cfa6a847a19ac95127c6ba0d442de68fb53f9bc2a848dff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 82ab7bc216508992cfdec3ff14189555ecbe5d01acee6de5e2070dc6b856bd53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 757aba5ed6182009d9763d6d980d4a361d6c12b8901b56a02fe4f92a9ae356a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 6c421ee8595d76761cbd1ef6a6349bd52d41e417e6a6d1b90925390c02ded723
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 b9b605df898c40be2fe4a5aa107f2e2cc6aaec7275c1984c6c7b9c4ee17f044c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-fibers-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-fibers-l1-1-0.dll
        • Size 21KB
        • SHA256 52409321d0592d076524d8dddfe26f2f667ff091ee18c6103818324eb9c57155
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 5637e943bff0c7c09bb75aecea1a4e5fc316ecaf9e68b65bb8b758c9c81bf34d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-file-l1-2-0.dll
        • Size 21KB
        • SHA256 41d981933ed13460e1b567c6ac379d471d9b93085ac682d3a55fa56469b312f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-file-l2-1-0.dll
        • Size 20KB
        • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 d1782ed45b2c4a2972dfa7355fdd3aabc4a3ef8a6fcdc43c922639995ff34d14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 c744f33dfb52ca3acacff0d5a9133f52d35a4d1320dfa9c33a66988fa1417f05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 5fccbc985f1a7224d88957576548f6ba33acb93cba5f5711f79260a190702a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 2ffc392a3824d624b819df9d99334330f4a7631b385f0a3663888ce3b3f9b858
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 91a3699844ddd7fb89f0d169aaf0016dc5d08fcb0993d0ebf8e0b0f81a359163
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 df993b3115061d54732528e3b59ef09332f088b2fde1e114a4f85f78f46e8b87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 c1372ee2d82d88e230de0c69608cc710bb1fed26571972ebe3b3160bbb979621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 0cc62cf54bf207b3d840ab84631875459551f0c9599d9fc97fffd95f169d5d39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 040484d95335e636997eb1420ccd25373df08e4b8966452eae04001129c009e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 21KB
        • SHA256 544496a7c788cf654525ac3a251afc1e0ee2388312049463be601e39266bd3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 e41fa81b75b996d901bf4423d5ed3ab3fdb6cc1983583c83dbb5ec673ff613a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 1eca84535031dc72a682375a9ad70c3cc4479ebb5983617407610ced722ea3a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 47a46e9c574e3bd8144d6d7ed31b9c5d0ca0b1ffc584b5eb3b37dd793d036a38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 ef2c75cb8d359cccc0e504ec5d82d6a97dce44442f340f6d28b8c4e61b817aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-synch-l1-2-0.dll
        • Size 21KB
        • SHA256 0779d4e8c5a2725d5e022039e41a8ced8b2818d66e43110b225d39662163f3e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 d7a58b7537fb4fab7388849eb3a44ba50dbb0c33f5bf1765a0800a4a2c522fac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-timezone-l1-1-0.dll
        • Size 21KB
        • SHA256 2663e7d276be5a3b39cabb680d856adfc1b9669e10ef01a7866219f6e81a1d43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 984c2f8ec4f7f46e0e7da550affe12df3bd3078b7575b86a34b4b2940133a7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 eade742fb10867f86328bebd0f78fde7ed7c513f56489913f32f582315564329
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-convert-l1-1-0.dll
        • Size 25KB
        • SHA256 d314c0bf7a78674ce535e97986416791712094c8ab5fdee527644e5664736ada
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-environment-l1-1-0.dll
        • Size 21KB
        • SHA256 adf45ff1c58be6d1a83865357d19002689062b6ca72c76782dbb499d27b15d15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 e96f46bdb5574f60123b0870fbb06cd7910d3d7218c865afc55a6fc76a749ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 b729880c5040bcff86eba9d18bd6da2d9fa7f8efad519cae0f4abe6157a1decd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-locale-l1-1-0.dll
        • Size 21KB
        • SHA256 132e12343708d4ede2650864105b09bd49e2b24d062d854a3e70d32d2094f3b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-math-l1-1-0.dll
        • Size 29KB
        • SHA256 76762745125dedae0414b1b23561fb712f592bde1c9c2e5d015a3739c6683ece
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 29KB
        • SHA256 9cbe35a45c589aeabd73b635dcfe6d640a45c9b5b45e3be26b4f25865e0b2a91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-private-l1-1-0.dll
        • Size 73KB
        • SHA256 7c67d2c07567cca059f1fc500e8c3468a7c31c29c44e20099bcaaa30c53d47a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 ac2371f6d3194665c8ac85d7872d713fae3f65a051d01859eedb3e5f5fc8c5ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 25KB
        • SHA256 7d321636547f88ecff2e7a31d77f6cb1992d2f52ff50f561d8c1546afcbf9c31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 25c1c1b0ba09b79c155d98c6d1bb334464b99aaafb329fbf3ead45bdd85ad4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 fc028cfcfe6bfe7c50380f1edbe9d684ef5545e19e55bd3d5e42d02e2f37d963
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 46f50ab159c3d8eef9d7ba4cafe2222bb2fcc7a0a9f86b3f30df8e89ec4f163c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\api-ms-win-crt-utility-l1-1-0.dll
        • Size 21KB
        • SHA256 a37c680e5108011dc4d12980a12d518e781c11fd3876c4f37e766fe5e1d9637a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\base_library.zip
        • Size 824KB
        • SHA256 738fdc2b7fb6ceed56b76a6d137cbebb2ee6fdbcce987653c5bc08fb0718ed06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 00a1eeb37372d11559bf44c9e68af9c841c41c95a173f3dfec4e0b5923d0cae0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-7.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\libssl-1_1.dll
        • Size 673KB
        • SHA256 1b57a201184559164dedbddcb43bb110a18cafa19ea3d00fc23274ccfc420e94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\pyexpat.pyd
        • Size 185KB
        • SHA256 39a24ebe6b49183c23e3fbdadf03ac0e121e370af5aaf25bd8347240d4e3de80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\python3.dll
        • Size 58KB
        • SHA256 d6c418dccf1f7d6ae51c9759dfbe290dfb6bfe42531a63dac177587bbc51e666
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python38.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\python38.dll
        • Size 4.0MB
        • SHA256 bfd4447f6638f72d9f0ecf9f8c5e3806dcc6a82291e273ca54791c59b83e91ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\select.pyd
        • Size 27KB
        • SHA256 ee31723548a959f207f4ea9b6392315d755b2cea5aa47586c0bc12863f594fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLER

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\setuptools-49.2.1.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512

        tcl86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\tcl86t.dll
        • Size 1.6MB
        • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/5564-1130-0x00000173A8E00000-0x00000173AACAF000-memory.dmp