Analysis
- max time kernel
148s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 18:20
Behavioral task
behavioral1
Sample
LACERZZ.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
LACERZZ.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target LACERZZ.exe
- Size 11.7MB
- Sample260827-wysmeszbmd
- SHA256 ffdc7a0a8b067a05013e70d9cedde4be77d74557a866a64db08f08f2a3eda41c
- MD5 3e5a735676ee0ef295c3e936a9b68524
- SHA1 781a97e70c3832ed4527d653492a2bbd89e91f45
- SHA512 a3ccdd8669f3c9526c73fef73776be4bf0c310c9f596e44f8f74dfb436acb3da8d7ceb89070fd5941cf4806c25c1b5e73b36fdf4aebacdb521dcd9188fa24f01
- SSDEEP 196608:TfgWH0p9L2Vmd6+DKMTNfwZHYYvvfLgq5IVdHljKTdK0ovO1Zu9ILpOM9/y7Oi:RUnL2Vmd6mKMBkXvfd5mFydK0sOFpOad
- TLSH T111C6334CBBB009CBE0DA5135C076E67873F3BF15CBA8C22F47588E857B836697496A50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
pid Process 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe 1564 LACERZZ.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1940 cmd.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2452 wrote to memory of 1564 2452 LACERZZ.exe 90 PID 1564 wrote to memory of 1940 1564 LACERZZ.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\LACERZZ.exe"C:\Users\Admin\AppData\Local\Temp\LACERZZ.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\LACERZZ.exe"C:\Users\Admin\AppData\Local\Temp\LACERZZ.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵
- Executes a command shell one-liner
PID:1940
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\VCRUNTIME140.dll
- Size 95KB
- SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
- MD5 f34eb034aa4a9735218686590cba2e8b
- SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
- SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
- SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
- TLSH T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_asyncio.pyd
- Size 60KB
- SHA256 2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e
- MD5 3aea41c0a41765d6b0eb3363804d94d0
- SHA1 26f05e3e458d5b90326ea40c6bbf236a3dbd49f0
- SHA512 a1f5eb597c43a053d28e16b48f365760189eeb129ac3ea1eaa3bb6648332c5f11a4a446d29dcd90e773858fb4b6367568fcd9c778ea1efee5d4972dcdfe4a0e6
- SSDEEP 1536:YWbvivBeDp/HmflsqHEY8ZIv5n4U7Syy0:YWbvaBelmflsqHEPZIv5nvE0
- TLSH T1E5537B86E2908194D967A074D8A30F46E771F6945B0403CF62ACD29E3F6335247FEB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_bz2.pyd
- Size 78KB
- SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
- MD5 d61719bf7f3d7cdebdf6c846c32ddaca
- SHA1 eda22e90e602c260834303bdf7a3c77ab38477d0
- SHA512 e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
- SSDEEP 1536:IzXz7Bgrj7FUHfuwtvm8hbvwyhIvtVx7SywqLZ:kXzVMFOfuiRhbvwyhIvtVxiqt
- TLSH T1A3838C92B3A495B5F05BB27985B10357E371BD0D03A093AFB794822F2F03B816D6536E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_ctypes.pyd
- Size 117KB
- SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
- MD5 3fc444a146f7d667169dcb4f48760f49
- SHA1 350a1300abc33aa7ca077daba5a883878a3bca19
- SHA512 1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
- SSDEEP 3072:sW66GKh4hqyIVQoavMSutRSfrSd4etFx3FIvQPVv96:T6QKtkSu3SfrS3xr4
- TLSH T114C35A1B235400AAEA67507CC5B35E47DB71B859572083CF02A4C69E2F67BE36E3E706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_decimal.pyd
- Size 242KB
- SHA256 4f1ecc777c30df39cd70600cd0c9dc411adb622af86287b612f78be2a23b352c
- MD5 8a2530a8d7e3b443d2a9409923eb1cba
- SHA1 cfa173219983c0c14d16f3fd21ea02c4dbb6c5bf
- SHA512 310831ce8bd56b0299536c2059748207d774ac965001b394a16e2dfeeb532be0362e0810f2a1f10dcffffdb0f523a5c592cb3f9bfe56fa766a4c409a2a052388
- SSDEEP 6144:IlUrIgCTez5owfMkgAj6irZD2TGLiOHy9qWMa3pLW1A2Pqil4LT3f97:IIIgiu5LUkgGnqGPY0m3f97
- TLSH T14E346C26A2490CA5DE778078C8975B57FBB278840360D38F43A4C9A73F576A327BE744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_hashlib.pyd
- Size 60KB
- SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
- MD5 0d75220cf4691af4f97ebcbd9a481c62
- SHA1 dadc3d5476c83668a715750ed80176dbbb536ec7
- SHA512 c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
- SSDEEP 1536:J7ejSMEDZN4ghT1mjWvfJ3ZIv5Ihp7Syif:J7ejrE/Tp1mjWHJ3ZIv5I3Af
- TLSH T10B537C06A74440A5C57383B8D9930FABE672F5845311A7EF5364C28E2F237C367BA791
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_lzma.pyd
- Size 151KB
- SHA256 75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
- MD5 afff5db126034438405debadb4b38f08
- SHA1 fad8b25d9fe1c814ed307cdfddb5cd6fe778d364
- SHA512 3334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc
- SSDEEP 3072:m0k3SXjD9aWpAn3rb7SbuDlvNgS4fWq0znfo9mNoXTSlvpBAxhIve1xc7:m0kiXjD9v8X7EukAwYOXTCexo
- TLSH T136E32892A394F0E6F3628C38D6624F57D7F578090320929A02CC976D2B1FB759E2E717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_multiprocessing.pyd
- Size 30KB
- SHA256 b2d81c59e7ba45ce85f557c67a02ebbb01433136b6dd5075afcf115f57b73115
- MD5 9af2f29d535a962701dc1b596a08e40c
- SHA1 eadb8e0cbfa90c3fd0343b25d57fd89ef23fc315
- SHA512 4d6604fb2f6507f2d00b9d86579f2d27e0e77dc3708847468a52c295891b1433ab71fe1d4614f6ae872eeab49236446a16af690f44b354741dcb88578e2e9faa
- SSDEEP 768:QZtYyJmJxGKaAo5dUJIvRtrbYiSyvwqeEn:QLYzJsKXo5dUJIvRtrb7SyIqF
- TLSH T1D6E27E53AA98149AD833C67198E35F19D532F646471083CF2364C39E1F723427BE6B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_overlapped.pyd
- Size 45KB
- SHA256 622171218fab2952c569acdbf0489d0098fa0664f61624d1c4f040410731be41
- MD5 84609daeef4ebd0725098c74a3772cbb
- SHA1 d4a9487f34ea36d097ecbba53a9410be268944af
- SHA512 b80e77d851137181445c8056abecf8b40647d49458897e306409f56084196cbef03d12d64ac2abd351dc6901fb5b3914bb5dbc5d490cfdb1aebb04be41e02eeb
- SSDEEP 768:KAM30iXUtee0Vb47XTTrlzXFOPRcqdc5U9IvstzYiSyvKpeE1:KAM3hRdcqd19Ivstz7SyipL
- TLSH T1B5236C42675800DDDA67827D94631E17E97478E04711C39FA268CB4E1F323D16BBB3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_queue.pyd
- Size 27KB
- SHA256 827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
- MD5 c8a1f1dc297b6dd10c5f7bc64f907d38
- SHA1 be0913621e5ae8b04dd0c440ee3907da9cf6eb72
- SHA512 e5f07935248f8d57b1f61fe5de2105b1555c354dd8dd98f0cff21b08caba17b66272a093c185ca025edb503690ba81d5fa8b7443805a07338b25063e2f7ea1b1
- SSDEEP 768:xxrUGCpj6rIydKp2VFIv7U/YiSyvcgeEH:DrU8IM22VFIv7U/7Sy0gB
- TLSH T1CAD29EC2AA585896D033C17094A35E19F931F791871183EF3329C36D1F237826BBA76B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_socket.pyd
- Size 74KB
- SHA256 9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
- MD5 f59ddb8b1eeac111d6a003f60e45b389
- SHA1 e4e411a10c0ad4896f8b8153b826214ed8fe3caa
- SHA512 873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf
- SSDEEP 1536:vmtvsZWgzruIAe9/s+S+ppyXc/+lvFIvQwx7SyWDd:u5IJzrAe9/sT+pp8c/SvFIvQwxQDd
- TLSH T1EE734A12A69051B9D67381BAC5635F23FB70F490179593CF1260CA6E1F237829E3EBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\_ssl.pyd
- Size 153KB
- SHA256 41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
- MD5 80f2475d92ad805439d92cba6e657215
- SHA1 20aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab
- SHA512 618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5
- SSDEEP 3072:09Y1GpXg28PqCBWZxVkc85/u9NkFc8j8V+AOXLkdWXxZIIkjIIhIvt79oF2:09Y0BgdqCETaXu9K6V+RrIE
- TLSH T1F9F37C47F28419A7E813E4BDC6630A42E7B5F045231197CE49D6C68A0F13B46AF7AF63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\base_library.zip
- Size 859KB
- SHA256 990a2d93f763e263d60d250dc0f5bce8b908e2a75e57c92d71d9b7d01a01681a
- MD5 612cc19154bf8529048eb5ceec4bf8a5
- SHA1 caf2208f9ed7b5cb25478ba89d3ba58065fa4042
- SHA512 649197f0e23f466fec35fda869069cb3063ead23d5f17eb3a4526c6e665653694855c678527538c99c672ebb2d1530afb11fbe9940ef516465f4536fce235ae9
- SSDEEP 12288:EEHYKmIBWSxC6SLcYPjA4a2Y+0dqVwxffpEnYpJSLMNmf:EEHYI1xsLa2FpVwxffpEnY0MNmf
- TLSH T113153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\libcrypto-1_1.dll
- Size 3.3MB
- SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
- MD5 ab01c808bed8164133e5279595437d3d
- SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
- SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
- SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
- TLSH T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\libffi-7.dll
- Size 32KB
- SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
- MD5 eef7981412be8ea459064d3090f4b3aa
- SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
- SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
- SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
- TLSH T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\libssl-1_1.dll
- Size 682KB
- SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
- MD5 de72697933d7673279fb85fd48d1a4dd
- SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
- SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
- SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
- TLSH T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\pyexpat.pyd
- Size 191KB
- SHA256 e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc
- MD5 4cb923b0d757fe2aceebf378949a50e7
- SHA1 688bbbae6253f0941d52faa92dedd4af6f1dfc3b
- SHA512 9e88542d07bd91202fcf13b7d8c3a2bbd3d78e60985b45f4fa76c6cd2a2abdee2a0487990bea0713f2ad2a762f120411c3fbbfaa71ef040774512da8f6328047
- SSDEEP 3072:yAYH5Hlzb+A9WJHX2088fYSi/qHi13hx+1Nsw3YdyCyIzfMsSzyo+Om3i3nlxvub:yL5F/+A9WJGH8QSiyHiSN9oyCyWfvy+b
- TLSH T1D5146C5B71A6C0EBD8938038D6D78B0BDAB1B8A5039087CF1294E77D5F27B523E68315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\python310.dll
- Size 4.2MB
- SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
- MD5 e9c0fbc99d19eeedad137557f4a0ab21
- SHA1 8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
- SHA512 74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
- SSDEEP 49152:sjpL4R07dkqlAC+j5mum37j64+QNdhIomafXXPoMpBdr3AtoD1s3tvVIdHwHasMD:sjpPkqe1t4zf3Ty9ydQHvMl/SE98EL
- TLSH T111267C22A26411A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EF706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\select.pyd
- Size 26KB
- SHA256 149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
- MD5 994a6348f53ceea82b540e2a35ca1312
- SHA1 8d764190ed81fd29b554122c8d3ae6bf857e6e29
- SHA512 b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f
- SSDEEP 384:rPjk/7e12hwheCzHqNYBsVRX+MIv7GnIYiSy1pCQaKEJ94i/8E9VFShf:TUC2hwhHHqyYVFIv7GIYiSyvQJ9eEwf
- TLSH T1D3C28F56AB909C86E8238571A5E58F06ED35B6A04720C3CF3365C21D2F12BC177BB76A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI24522\unicodedata.pyd
- Size 1.1MB
- SHA256 0f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
- MD5 c01a5ce36dd1c822749d8ade8a5e68ca
- SHA1 a021d11e1eb7a63078cbc3d3e3360d6f7e120976
- SHA512 3d4e70a946f69633072a913fe86bada436d0c28aca322203aa5ec9d0d7ae111129516d7adb3fdeef6b1d30b50c86c1de2c23a1bc9fba388474b9d9131c1e5d38
- SSDEEP 12288:rdlBMmuZ63NAQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+u+SQ:hlBurZV0m8wMMREtV6Vo4uY+SQ
- TLSH T18F355909B9C24EE6E88B06B940D3117B2F61C1720F1B6B4F76A5532D9C763A34EE653C
- MD5 SHA1 SHA512 SSDEEP TLSH