Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 01:11
Behavioral task
behavioral1
Sample
ᵇʸᵖᵃˢˢ⳻᷼⳺.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ᵇʸᵖᵃˢˢ⳻᷼⳺.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target ᵇʸᵖᵃˢˢ⳻᷼⳺.exe
- Size 9.0MB
- Sample260822-bkbrjaea26
- SHA256 76a2840f69f6bf92f9f855391758150e994bb9f1fe9f6f2d8c0a8921d5a73665
- MD5 d82fb3f77acc1be4814496668796275f
- SHA1 f92f3b2aa02da5a93fa82241792eef84cc5c2d66
- SHA512 5919446e7cd8b15c7ae362c5be0fcf63176dfe86d373bc93a1f6068635e754e2b656665ba8139587d51a0225b0d60afb23c8427b132d06cacc2e721938f38a09
- SSDEEP 196608:QKVEx7E0wglsnqICteEroXxWVfEqlbkkwR7VTEJ4tSYJioBLyx7:tKlwgeqInEroXgfEqirRRoJ4tSYJicK
- TLSH T1689633256F500CDFF2A5013885B0AB28C17972E25B16DB83BF6855669F63FE87D72E00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts ᵇʸᵖᵃˢˢ⳻᷼⳺.exe - Loads dropped DLL 15 IoCs
pid Process 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 3268 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 996 wrote to memory of 3268 996 ᵇʸᵖᵃˢˢ⳻᷼⳺.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ᵇʸᵖᵃˢˢ⳻᷼⳺.exe"C:\Users\Admin\AppData\Local\Temp\ᵇʸᵖᵃˢˢ⳻᷼⳺.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\ᵇʸᵖᵃˢˢ⳻᷼⳺.exe"C:\Users\Admin\AppData\Local\Temp\ᵇʸᵖᵃˢˢ⳻᷼⳺.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
PID:3268
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\VCRUNTIME140.dll
- Size 94KB
- SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
- MD5 11d9ac94e8cb17bd23dea89f8e757f18
- SHA1 d4fb80a512486821ad320c4fd67abcae63005158
- SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
- SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
- TLSH T14C936B4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6866A5F67BE05E3D355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_bz2.pyd
- Size 84KB
- SHA256 9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
- MD5 124678d21d4b747ec6f1e77357393dd6
- SHA1 dbfb53c40d68eba436934b01ebe4f8ee925e1f8e
- SHA512 2882779b88ed48af1e27c2bc212ddc7e4187d26a28a90655cef98dd44bc07cc93da5bce2442af26d7825639590b1e2b78bf619d50736d67164726a342be348fa
- SSDEEP 1536:26r9z7HMjxuqMfXA5eogNEkqpltT88tOHiy387pI8MVJZyyD:26RzI7M45HkEkqpl68sHiy3GpI8MV1D
- TLSH T169838D92B3A056F5F4ABF17896B0434BE371B8094390D3BFA268425B1F03B917D6971E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_ctypes.pyd
- Size 123KB
- SHA256 1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
- MD5 7ab242d7c026dad5e5837b4579bd4eda
- SHA1 b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f
- SHA512 1dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30
- SSDEEP 3072:7sO10M2JpWk4bwqTE72danzifrZewqVlI8BPak:Ii0Moqds2TfrZ5qV2k
- TLSH T184C34A1B735400AAEA678178C4B35F07DBB2B412472097CF0294C69A2F637E26E7FB45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_hashlib.pyd
- Size 64KB
- SHA256 7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
- MD5 ae32a39887d7516223c1e7ffdc3b6911
- SHA1 94b9055c584df9afb291b3917ff3d972b3cd2492
- SHA512 1f17af61c917fe373f0a40f06ce2b42041447f9e314b2f003b9bd62df87c121467d14ce3f8e778d3447c4869bf381c58600c1e11656ebda6139e6196262ae17e
- SSDEEP 768:Uyz+AYBOAMfR5UUtgx56xDzyDcp0syKZ8te7POCyhI8YIvDG4yU5hH97:NfrTgz2iW9it4OCyhI8YIJyUDl
- TLSH T107535B4A974400E4D87781B9D9A30E97EA71F5106301A3DF9364C2CE2F23BD367BAB59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_lzma.pyd
- Size 159KB
- SHA256 4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5
- MD5 a77c9a75ed7d9f455e896b8fb09b494c
- SHA1 c85d30bf602d8671f6f446cdaba98de99793e481
- SHA512 4d6d93aa0347c49d3f683ee7bc91a3c570c60126c534060654891fad0391321e09b292c9386fb99f6ea2c2eca032889841fce3cab8957bb489760daac6f79e71
- SSDEEP 3072:4aV4EP3esMbwjQneCJP8dTGDEiznfo9mNoXldfir3pI8D1WGZ:4aV4EP3nMKQZ+0DEUwYOXer3OGZ
- TLSH T1FCF32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_queue.pyd
- Size 28KB
- SHA256 b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f
- MD5 e64538868d97697d62862b52df32d81b
- SHA1 2279c5430032ad75338bab3aa28eb554ecd4cd45
- SHA512 8544f5df6d621a5ff2ca26da65b49f57e19c60b4177a678a00a5feb130bf0902f780b707845b5a4dd9f12ddb673b462f77190e71cbe358db385941f0f38e4996
- SSDEEP 384:vYc3ZiJOXiUi3Q2hv6P6rglvby3njszCcglI8mUjDG4y8mcL5O8hHA:0OXQ3I6rgleAylI8mUjDG4yjAO8hHA
- TLSH T1F2D27C82E79418D2E933C175A4E29F26F972BB025311C3EF222882595F37782747E76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_socket.pyd
- Size 78KB
- SHA256 241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
- MD5 4b2f1faab9e55a65afa05f407c92cab4
- SHA1 1e5091b09fc0305cf29ec2e715088e7f46ccbbd4
- SHA512 68070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3
- SSDEEP 1536:NBM6HuD4Zb7hmyAM9/s+m+p+nUivSrpZZ3lI8BwDyjgs:YeBHAM9/sb+pYNSrb1lI8Bwps
- TLSH T199735B01A7A051F5D673807AC2679F23F7B0B48013A5A38F4164CA6A1F237D2BE7DB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\_ssl.pyd
- Size 151KB
- SHA256 31c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7
- MD5 6f52439450ad38bf940eef2b662e4234
- SHA1 3dea643fac7e10cae16c6976982a626dd59ff64a
- SHA512 fdd97e04f4a7b1814c2f904029dfb5cdfcd8a125fce884dcd6fdb09fb8a691963192192f22cf4e9d79dd2598cf097a8764aeec7a79e70a9795250c8ef0024474
- SSDEEP 3072:d+WZiO1vJpfdaywIj2jmN109OV0hVEykq7SOH70NmHh4kwooSLteSdN1LpI8M7KY:deO1vJpfknIjd6VhVJ7S4DthN1LnY
- TLSH T1FBE37D43B2441AB7E813E4BDC6234A02E7A5F105230197DE85D6DA450F07B4ABE7BFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\base_library.zip
- Size 781KB
- SHA256 f22c9545970e2e5528e6816e386bdbbdd9546c5f73d51d2d1768c5a2fdbed1ef
- MD5 fa1dbd258977aa199159d1c9345054d4
- SHA1 2b328f7fbd1ca4ad058841cebd1c65bcb59435e8
- SHA512 3b148b7aeaf56a9279895de337e6aaf509e08b7c85f6950c6f6794d297586051a242961ade77230f609576e560bfdc85a775224830af966ae84993d5206cdbf0
- SSDEEP 24576:wK738OCQcosQNRs54PK4ItDVwHLfVEXokSCH:wK738O9cosQNRs54PK4I6g
- TLSH T182050840BAA25DD7FD09F27D412ECA1C4A6A5239DB48D203794FC3983F4B3E41E36A59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\libcrypto-1_1.dll
- Size 3.3MB
- SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
- MD5 63c4f445b6998e63a1414f5765c18217
- SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
- SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
- SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
- TLSH T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\libffi-7.dll
- Size 32KB
- SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
- MD5 eef7981412be8ea459064d3090f4b3aa
- SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
- SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
- SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
- TLSH T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\libssl-1_1.dll
- Size 678KB
- SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
- MD5 bd857f444ebbf147a8fcd1215efe79fc
- SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
- SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
- SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
- TLSH T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\python3.DLL
- Size 58KB
- SHA256 84cb29052734ec4ad5d0eac8a9156202a2077ee9bd43cabc68e44ee22a74910a
- MD5 d188e47657686c51615075f56e7bbb92
- SHA1 98dbd7e213fb63e851b76da018f5e4ae114b1a0c
- SHA512 96ca8c589ab5db5fde72d35559170e938ce283559b1b964c860629579d6a231e1c1a1952f3d08a8af35d1790228ac8d97140b25b9c96d43f45e3398459ae51bc
- SSDEEP 768:An+mYEBMcEfpzVHBlAUcfc0la6Wc6kH/ZFJ1Yu+wNBECaOMyCgUhkb0E/GdlI8Bw:A+mYEBMofwkYlI8B0KyzyO
- TLSH T193436F525954FCA3DBEA2DFF38D19DC964E912CC812684DCA97892D30F5A233AD2734C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\python39.dll
- Size 4.3MB
- SHA256 e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
- MD5 7e9d14aa762a46bb5ebac14fbaeaa238
- SHA1 a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9
- SHA512 280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023
- SSDEEP 49152:yV2AZJ2D90f3gXG9Fo6fxOWzB/um/1S3pWiN9vXWYv4AvGi1r/onEHcPaRryThwk:ugD9cRVo3IkaeBmn3qCHDMo9wQ
- TLSH T18D267C22639401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\select.pyd
- Size 28KB
- SHA256 5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
- MD5 f8f5a047b98309d425fd06b3b41b16e4
- SHA1 2a44819409199b47f11d5d022e6bb1d5d1e77aea
- SHA512 f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9
- SSDEEP 768:3YyAU126JwhQHqJ8PzlI8mG6DG4yj4ZhH1K:T86WhQKJ8PzlI8mG+yjE1K
- TLSH T121D25B56EB6468C6EA678131E4D1AF0BE835B6170711C3CF5329C2291F237C27ABE359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI9962\unicodedata.pyd
- Size 1.1MB
- SHA256 ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da
- MD5 87f3e3cf017614f58c89c087f63a9c95
- SHA1 0edc1309e514f8a147d62f7e9561172f3b195cd7
- SHA512 73f00f44239b2744c37664dbf2b7df9c178a11aa320b9437055901746036003367067f417414382977bf8379df8738c862b69d8d36c6e6aa0b0650833052c85f
- SSDEEP 12288:bezMmuZ63N7QCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uE1SJ:bezusZV0m88MMREtV6Vo4uYEgJ
- TLSH T110355909B9C24EE6E89B067940D3117B2F61C1720F1B6B4F76A5532D8C763A34EEA53C
- MD5 SHA1 SHA512 SSDEEP TLSH