Overview

overview

10

Static

static

10

فضي.exe

windows10-ltsc_2021-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    35s
  • max time network
    40s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    31/08/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    فضي.exe
  • Size 109.1MB
  • Sample260831-2b2jpssxbx
  • SHA256 18db7f2f7890839828bc91480005b1db1cd978ff6d99738db7d7a5a214708d51
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 53 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\فضي.exe
    "C:\Users\Admin\AppData\Local\Temp\فضي.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\فضي.exe
      "C:\Users\Admin\AppData\Local\Temp\فضي.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "where python"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3608
        • C:\Windows\system32\where.exe
          where python
          4⤵
            PID:2640

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_asyncio.pyd
          • Size 69KB
          • SHA256 0d4fbd46f922e548060ea74c95e99dc5f19b1df69be17706806760515c1c64fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_bz2.pyd
          • Size 82KB
          • SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_cffi_backend.cp312-win_amd64.pyd
          • Size 177KB
          • SHA256 9af5e4f68a41f26b726f2e9424f9d58a4f5666189f6a48be95f406b257102aec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_ctypes.pyd
          • Size 121KB
          • SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_decimal.pyd
          • Size 247KB
          • SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_elementtree.pyd
          • Size 130KB
          • SHA256 9bfb6f4a1ce9507cc6858b29f218341fa43d4b1ec77f44fdb58333170874bd22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_hashlib.pyd
          • Size 63KB
          • SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_lzma.pyd
          • Size 155KB
          • SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_multiprocessing.pyd
          • Size 34KB
          • SHA256 fb69005b972dc3703f9ef42e8e0fddf8c835cb91f57ef9b6c66bbdf978c00a8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_overlapped.pyd
          • Size 54KB
          • SHA256 5d298bb811037b583cff6c88531f1742fae5eee47c290adb47ddbd0d6126b9cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_queue.pyd
          • Size 31KB
          • SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_socket.pyd
          • Size 81KB
          • SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_sqlite3.pyd
          • Size 121KB
          • SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_ssl.pyd
          • Size 173KB
          • SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_tkinter.pyd
          • Size 62KB
          • SHA256 06ea475cbb786bd1db1c1bbd62546446e571f717303fcf868148e15612a04a65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_uuid.pyd
          • Size 24KB
          • SHA256 bb418e91e543c998d11f9e65fd2a4899b09407ff386e059a88fe2a16aed2556b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_wmi.pyd
          • Size 35KB
          • SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zoneinfo.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\_zoneinfo.pyd
          • Size 46KB
          • SHA256 7fd9a55b2c87b4df417f3bab7b76358872cea2f246122ef51a892fdbecbf385a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
          • Size 222KB
          • SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_parser.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\aiohttp\_http_parser.cp312-win_amd64.pyd
          • Size 254KB
          • SHA256 2851a840224d139cc3c73534597b1c29b1ee6094661e27def04b3cd66d4199c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_writer.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\aiohttp\_http_writer.cp312-win_amd64.pyd
          • Size 43KB
          • SHA256 4831aaf297de92c195335564e4b13d3df50e3e88f25b22532c5b576ecb3a3a1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\base_library.zip
          • Size 1.3MB
          • SHA256 b5bfa9f594ff5e8693b4df0169441059acf6a26abb08e028d5373f7997f1e9de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\libcrypto-3.dll
          • Size 4.9MB
          • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\libssl-3.dll
          • Size 771KB
          • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\multidict\_multidict.cp312-win_amd64.pyd
          • Size 79KB
          • SHA256 a7411fadf931b119427b537fcc6467f63179a7a7c29c603b89b1bc8be0733f8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _helpers_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\propcache\_helpers_c.cp312-win_amd64.pyd
          • Size 61KB
          • SHA256 c31395d9bc4730221b97e81708658827b7fdf3432152025d32b6a5520959ca1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\pyexpat.pyd
          • Size 195KB
          • SHA256 e1d56ffbf5e5fab481d7a14691481b8ff5d2f4c6bf5d1a4664c832756c5942fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\python3.dll
          • Size 66KB
          • SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\python312.dll
          • Size 6.6MB
          • SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\select.pyd
          • Size 30KB
          • SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\sqlite3.dll
          • Size 1.4MB
          • SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tcl86t.dll
          • Size 1.7MB
          • SHA256 28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tk86t.dll
          • Size 1.5MB
          • SHA256 23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Conakry
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Africa\Conakry
          • Size 130B
          • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Djibouti
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Africa\Djibouti
          • Size 191B
          • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Kigali
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Africa\Kigali
          • Size 131B
          • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Lagos
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Africa\Lagos
          • Size 180B
          • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Curacao
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\America\Curacao
          • Size 177B
          • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Toronto
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\America\Toronto
          • Size 1KB
          • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EST
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\EST
          • Size 149B
          • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Greenwich
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Etc\Greenwich
          • Size 111B
          • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
          • MD5 SHA1 SHA512
          Submit Download

          London
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Europe\London
          • Size 1KB
          • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Oslo
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Europe\Oslo
          • Size 705B
          • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Skopje
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Europe\Skopje
          • Size 478B
          • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MET
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\MET
          • Size 1KB
          • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PRC
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\PRC
          • Size 393B
          • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Wallis
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Pacific\Wallis
          • Size 134B
          • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Yap
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\Pacific\Yap
          • Size 154B
          • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UCT
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\UCT
          • Size 111B
          • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
          • MD5 SHA1 SHA512
          Submit Download

          Mountain
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\tzdata\zoneinfo\US\Mountain
          • Size 1KB
          • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\unicodedata.pyd
          • Size 1.1MB
          • SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          winsound.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\winsound.pyd
          • Size 29KB
          • SHA256 58907d9f68ca111bf3d5751b989a53be4af516652ac2ee8a48ff6cb31e457445
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\yarl\_quoting_c.cp312-win_amd64.pyd
          • Size 81KB
          • SHA256 729d917642f071de55ec31924df4d180d26fafa34561b73f035a5fe1bd8eb0c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21682\zlib1.dll
          • Size 141KB
          • SHA256 c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download