Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/08/2026, 22:17
Behavioral task
behavioral1
Sample
6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe
- Size 6.9MB
- Sample260830-17c1js1dpd
- SHA256 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8
- MD5 5ce22692ca559926274cacfd97178023
- SHA1 ce094d7615361a6030e634f0a4e4395f83aac927
- SHA512 25b3ca7788d2219c00de4b1229c0ebe5d46f46f297c6ee3a88c07772c4192103c84d35e727034396b1036d1144724af27074485e0e7f161eb0fe9b08f0e6c6da
- SSDEEP 196608:2d393zOXMCHGLLc54i1wN+KV0cSXl74w4Uqo881zl16:ct3zOXMCHWUjyVg74w0oH6
- TLSH T18D763348A9E416F7E9F7D13DDAE1D41AE324B8691FB3D9D343E082622F230D44936792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 3416 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe 3416 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe 3416 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe 3416 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3416 2000 6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe"C:\Users\Admin\AppData\Local\Temp\6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe"C:\Users\Admin\AppData\Local\Temp\6929111436de76504a2526e5f4d16b2e7e47dccce7faaabba4182225fe98a5c8.exe"2⤵
- Loads dropped DLL
PID:3416
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_bz2.pyd
- Size 84KB
- SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
- MD5 057325e89b4db46e6b18a52d1a691caa
- SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
- SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
- SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
- TLSH T15D839E86F79567F2F45B81B686C103A7E771BA91031093AFF258C2552F03F816E6C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_decimal.pyd
- Size 273KB
- SHA256 f4a486a0ca6a53659159a404614c7e7edccb6bfbcdeb844f6cee544436a826cb
- MD5 f465c15e7baceac920dc58a5fb922c1c
- SHA1 3a5a0156f5288f14938494609d377ede0b67d993
- SHA512 22902c1bcca7f80ed064e1e822c253bc8242b4e15e34a878a623e0a562a11203b45d5ff43904268322a7ef5cebb8e80e5fe1f1f1bcaa972e219348f84a1daf5f
- SSDEEP 6144:tQ1cVo7LuKmJCOAzCL9qWM53pLW1AATIxYOqMtz3BMchV:tQ4oX5mAOCCubYObV3mE
- TLSH T116546B57A2080CA8EE738574D9579B47E7B27C560361C28F43A48AA77F933A3636E344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_hashlib.pyd
- Size 63KB
- SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
- MD5 cf4120bad9a7f77993dd7a95568d83d7
- SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
- SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6
- SSDEEP 1536:jLDxflFwY9XDhWjLTNwjg40nEdIDvI/7yo47Q9LfIi7K:jJ92AT63Nag40nEdIDvI/EF
- TLSH T1BE538C44A29480A6CA6742B4CAE39F87F6B1F2425740ABDF0354C1CD1F237C3D6BA75A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_lzma.pyd
- Size 155KB
- SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
- MD5 3e73bc69efb418e76d38be5857a77027
- SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
- SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
- SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
- TLSH T128F35B86A394F0E5F7728C78D6624F57E7F5781A0320928A01CC976D2B1FB659E2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_socket.pyd
- Size 82KB
- SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
- MD5 69c4a9a654cf6d1684b73a431949b333
- SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
- SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16
- SSDEEP 1536:quV3gvWHQdMq3ORCnOypTAQlyJ+9+nztYwsFF6t7lCuZIDywN7yo47Q9EfIb5:quVQvcQTqypTAQlyJs+nztYtF6ntZIDv
- TLSH T17F836B01A69041FAEBA3C1B5C2679E23FB74F5C11395975F00A6C55A1F333C2AF3AA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\base_library.zip
- Size 1.3MB
- SHA256 7c12923d125e2d3d7f60047fb080e6f888feab9d6a03dde982607282a1cb7ced
- MD5 9399caabe11498b92b466cb41403e362
- SHA1 66f6728a713b11add6a89f69fa1cc34fe759a6e9
- SHA512 8c02d99b16c6c905efa108f9663dedf3a293abc13bdc9a89e95df090db47e452d1c894be746d2df481888f62f6db55acc12ba1f1ae1ac0b05fd287caf4fd857d
- SSDEEP 12288:2WaJW7WpduuOBa80201jwCVRDVoioSYBqi2cPPdxhYrL+DyiiZHdjdTRwJpWT6eH:n7Wpozq5cPPdxhYBJdZRwJ/SeT1GF
- TLSH T10A550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\libcrypto-3.dll
- Size 5.0MB
- SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
- MD5 123ad0908c76ccba4789c084f7a6b8d0
- SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
- SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
- SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
- TLSH T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\python313.dll
- Size 5.8MB
- SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
- MD5 501080884bed38cb8801a307c9d7b7b4
- SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
- SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
- SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
- TLSH T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\select.pyd
- Size 31KB
- SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
- MD5 2663e22900ab5791c6687a264473ae1e
- SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
- SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
- SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
- TLSH T1CBE27C8F6A785087EA93C6B181A2DE43FC39B793861182CF30A5D59D0E537C1B73A359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\unicodedata.pyd
- Size 694KB
- SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
- MD5 c0b4c55ce3711af914b2015f707e4452
- SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
- SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
- SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
- TLSH T185E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH