5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
Size 10.7MB
Sample260827-evesqaxwdw
SHA256 5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977
MD5 f092620c7c55a4cf437992aa1849d5ce
SHA1 2a9a0976285f8a99000d1a9832d3130ec8f4581d
SHA512 14d9e8e06ce93a7667d64decf117bcca009b2d59a6e9fba06b67b8708c6801753083ed6074289b39b222128233be6e14230ec538e8f8709f4c6c6fb314231c56
SSDEEP 196608:nmHGi50W8UA3c3eKnGCxdGjP5Gi2bjKVPy2wE4/FeVHxvEQNwuCpvCRAX:mH7aW8MOKnGCnGjMi2bjRo4NeVHxvEkI
TLSH
T107B63384BBC504D4E89A5279C8D2A677D6F4BC321754C68B2BF24D122E231F6FE38764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
4652	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4652	5780	5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe	91

C:\Users\Admin\AppData\Local\Temp\5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
"C:\Users\Admin\AppData\Local\Temp\5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe
  "C:\Users\Admin\AppData\Local\Temp\5927eb6af57b79579b16f919fcc47b1dbd3fd0445c52a020150107527d423977.exe"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:4652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\_tkinter.pyd
Size 68KB
SHA256 fc9d4feb5f7e802f57cdf139c06b230c1a1aff28809bbcdb2e6da3adaba7d0ca
MD5 2067d4aa5289868d71171fc36bfcfede
SHA1 6b4d94d960290085025e2eb89c41069c87eb7565
SHA512 aba639571fbfa8cf4ea7a58f12e6bc1bb66afcbe260e03c6cfd012362e28fe2d0f3fe97c7240371d26e7f7ff579816fcc87d336d1964bd2ac79496019c4f33a1
SSDEEP 1536:C6f9aZoKcQRWhUDlU9oUq41su+46zyxIFvSTIy1Ni9tfIkeC:C6lJKDlPb41o43xIFvSTd2
TLSH
T117637D9BA7A4008BDEA7C135C5B39F13F675B6521A10920F01A4D39A2F333D3A7BA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\base_library.zip
Size 1.3MB
SHA256 e43b34d42a8df4831f70c7ef2c2968b8d2df5a9c8e5b5a702a41984a6cc9effc
MD5 8e4642272b7c6eb8b10ad731d399d9df
SHA1 f39f809ee3da5523636f58403b7fc12c7ed4d54c
SHA512 e96b3eea2351aebb92c85e49d155e32f12ec0f96bbc4027c1df0c17b581b9d1b781f5a14ec30bb99e379ce9d76c33812bbbc477d56bd35e51ef768775321139c
SSDEEP 12288:Vw3UKRIThwsE9iMdjdTUW7Wpd6/g7BFWtuIva80201jwCVRDVoioSYCjtYzGN8TX:VwpUw5dZF7WpIxSuTxu75cPPdxhYrM
TLSH
T1B8651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\tcl86t.dll
Size 1.8MB
SHA256 c2785dca49e07573356f036ab4bca054b306165d827a97c67fb0db4ed93c9c79
MD5 49bd88e384ebda21c457aa82aa46bbe8
SHA1 e5f13216c70e054e6c2acca766d2253f2254f5fb
SHA512 e1560b0b986169407c692ad250ae40be9f27be60ea9fb956db195a620550c1e02bc29d81c53fc50bb73432fa266cedfd2f0a957f87605836f88ffd3515cfd42c
SSDEEP 49152:K0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGF:DBUqMR7i6x9T+F
TLSH
T1AE859E1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\tk86t.dll
Size 1.5MB
SHA256 a89247c1a578935a3fab088a98611d3bd4204af9dcbabcb33706af698a962bca
MD5 6280826e37b97188c0d38638cde1ed9d
SHA1 212936d687cf23388189f56727446ef7284808a0
SHA512 e3286c2e86b5632f6ae2c4b1e8075b48e80433e4e18e5d63761367985d3291773c0454b5c531cc94e00dd6e82e1f2794970436c7e8258fc0d40a0163d7b13fb1
SSDEEP 49152:h76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezfb:+QchLNqaJvARxr9DrTwylL1y5BEq8JTk
TLSH
T1C7754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000016942\zlib1.dll
Size 144KB
SHA256 bfb680c8f3eca7c150661be65c7e3bd16965aa5056be0b4f22992a1388c73504
MD5 e31b2d2ca7d1c119f8a1aa05dd367e33
SHA1 6777f771b7ab6d2ec19abb839bc51ffb06b720ac
SHA512 00613ad3664a5103d833319a4addc1b8fe213b14fd4cda99723708cbceaa799993dd693e79271978c7668f0255ce882f846042abaa594b74cba0564881149de4
SSDEEP 3072:2vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCkT9o:2sVD+RrFgvi7Jx9o
TLSH
T174E38E9BB6A215BDC677817042E787B2F932B8214B309DEF5098D7741A12F806B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToCopy.mp4

Path C:\Users\Admin\Desktop\ConvertToCopy.mp4
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

memory/4652-1008-0x00007FFA5AB00000-0x00007FFA5AB29000-memory.dmp

Download