Analysis
- max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 09:44
Behavioral task
behavioral1
Sample
client.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
client.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target client.exe
- Size 7.8MB
- Sample260907-lqfyjsteme
- SHA256 6d5694d997c36ef796b2fb8c5744e43ec721a5c6209f604bda20dff0ac0a406f
- MD5 60cebaf3d664ad27d62070098fcd4af0
- SHA1 1fa3c95e60a10fd0bf8a3edf19f4474882db9a0f
- SHA512 76c79c0ba29aa32e7ed07e5438a9e18d744650defa9f69e469553e34ac29953c8c47776608e5cfbab697a03adab9df8d1a29be5050a7ad532fdda5e22c3d2bea
- SSDEEP 196608:GPH8bcXMCHGLLc54i1wN+lPIcu9KYK39sBb3PPuNMrRccx:GEYXMCHWUjqcuIEb/PuNC
- TLSH T1AC863304A6E011FED6F3403DEAE21295D9BA78764771CAEB43E453516E233E08E39727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3820 client.exe 3820 client.exe 3820 client.exe 3820 client.exe 3820 client.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3820 client.exe 3820 client.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2756 wrote to memory of 3820 2756 client.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3820
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ac42\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ac42\_bz2.pyd
- Size 82KB
- SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
- MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
- SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
- SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
- SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
- TLSH T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ac42\_lzma.pyd
- Size 154KB
- SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
- MD5 1ba022d42024a655cf289544ae461fb8
- SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
- SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
- SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
- TLSH T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ac42\base_library.zip
- Size 1.3MB
- SHA256 8c5cad1d65ec5c4b48995ae6e3207d023188e174714402d20caa7168938999bc
- MD5 2e17b6e0718053e5b714cb09e9b90919
- SHA1 36e92d416a2818bcf33d8f48d5bb2afa912d5dbf
- SHA512 f09e1f0b1e36cf72d6caaefa401a5ee8c53b0ed06741f30086dd46264d7234e622ec2317caebd51780f242be1f2630f3723b5098fca4526f22e8d7f6de6288e2
- SSDEEP 12288:UZcNAgn/6JaedjQSG6RXN74i2cPudx5/2L+DTdm3HS91lHauOBg80201jwCVRDV8:1/Yddi5cPudx5/a3SHkRsHau7WpZ
- TLSH T1E5551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ac42\python313.dll
- Size 5.8MB
- SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
- MD5 b9de917b925dd246b709bb4233777efd
- SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
- SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
- SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
- TLSH T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ac42\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH