Overview

overview

7

Static

static

3

OneShot - ...AI.exe

windows10-2004-x64

7

OneShot - ...AI.exe

windows11-ltsc_2024-x64

7

Resubmissions

21/08/2026, 17:18

260821-vvdtesthra7

21/08/2026, 16:36

260821-t39qdsxxhy7

Analysis

  • user interaction
    yes
  • max time kernel
    153s
  • max time network
    167s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 17:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OneShot - Smart AI.exe
  • Size 304.9MB
  • Sample260821-vvdtesthra
  • SHA256 bf4cf62de2c35eddbf97303726a98d6f5f9e956ae9e3efcb21ee85aee98ed8da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 58 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OneShot - Smart AI.exe
    "C:\Users\Admin\AppData\Local\Temp\OneShot - Smart AI.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6948
    • C:\Users\Admin\AppData\Local\Temp\OneShot - Smart AI.exe
      "C:\Users\Admin\AppData\Local\Temp\OneShot - Smart AI.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DirectML.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\DirectML.dll
        • Size 17.7MB
        • SHA256 0690ed74f6e119aa669584b651ea2527d3c3d09234bf3546b9ce01687138f946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\MSVCP140.dll
        • Size 544KB
        • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\MSVCP140_1.dll
        • Size 35KB
        • SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\PIL\_imaging.pyd
        • Size 2.3MB
        • SHA256 b231d11718a12994a32e744b93f830e931409ae13faeb150d9f020a2e81cb18c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\_bz2.pyd
        • Size 82KB
        • SHA256 403e76fe18515a5ea3227cf5f919aa2f32ac3233853c9fb71627f2251c554d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\_ctypes.pyd
        • Size 120KB
        • SHA256 e28d4e46e5d10b5fdcf0292f91e8fd767e33473116247cd5d577e4554d7a4c0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\_lzma.pyd
        • Size 155KB
        • SHA256 ad0440ca6998e18f5cc917d088af3fea2c0ff0febce2b5e2b6c0f1370f6e87b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\_socket.pyd
        • Size 77KB
        • SHA256 301c47c4016dac27811f04f4d7232f24852ef7675e9a4500f0601703ed8f06af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\_tkinter.pyd
        • Size 62KB
        • SHA256 ede5013c8b6ac68c05d5ac124fec7f94ecb2e445fd2f88c0c24eb3dc55c56bd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.json
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\customtkinter\assets\themes\blue.json
        • Size 4KB
        • SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-43e11ff0749b8cbe0a615c9cf6737e0e.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\numpy.libs\libscipy_openblas64_-43e11ff0749b8cbe0a615c9cf6737e0e.dll
        • Size 19.4MB
        • SHA256 634687ca5fedef76e784d8c54fc4ba2f965a44c0b60d754c49174589deab8157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-263139962577ecda4cd9469ca360a746.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\numpy\_core\_multiarray_umath.pyd
        • Size 4.0MB
        • SHA256 d22f78700f57661ef6bb91aa62fe488d9d34e5794d194c3dcbac7d3b46964dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\numpy\linalg\_umath_linalg.pyd
        • Size 105KB
        • SHA256 48d6fd29b984c29c2e2c41122029ef1d686fd9230c859740d91dd133017e4355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        onnxruntime_providers_shared.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\onnxruntime\capi\onnxruntime_providers_shared.dll
        • Size 21KB
        • SHA256 f4254ac34c7ce00b78c497825f5d9517f125092ee08e7badbe3d94e98bf66a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        onnxruntime_pybind11_state.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\onnxruntime\capi\onnxruntime_pybind11_state.pyd
        • Size 21.4MB
        • SHA256 b1d1ca1371d2348ede65f01960303c1dea19150a6f5acb9d7c7612948eab4b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\python3.dll
        • Size 65KB
        • SHA256 e45452efa356db874f2e5ff08c9cc0fe22528609e5d341f8fb67ba48885ab77d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\python311.dll
        • Size 5.5MB
        • SHA256 53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\pywintypes311.dll
        • Size 132KB
        • SHA256 074a73db77cbd9a8a1eed34dbfeddcea2d5772d34f8761b94957ae463c9a16ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt5core.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\qt5core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\select.pyd
        • Size 29KB
        • SHA256 8a9a103bc417dede9f6946d9033487c410937e1761d93c358c1600b82f0a711f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\tcl86t.dll
        • Size 1.8MB
        • SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\tk86t.dll
        • Size 1.5MB
        • SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\win32api.pyd
        • Size 131KB
        • SHA256 cd52611ae8331959797d4a6e1087bdb4816a3ffabf97bfd135568786339a9ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32file.pyd
        • Path C:\Users\Admin\AppData\Local\b7KpT3Q9xLm2Z\win32file.pyd
        • Size 140KB
        • SHA256 cac9f2e4a65cc6a69ae477c4162433c7f0cb678b1de2cf341ecc7a890537f7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2608-1243-0x00007FF8519E0000-0x00007FF852D46000-memory.dmp
        Download