Overview

overview

7

Static

static

3

gallery-dl.exe

windows10-2004-x64

7

gallery-dl.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 12:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gallery-dl.exe
  • Size 10.0MB
  • Sample260908-pntcmsbm3y
  • SHA256 b3ac6519ed465d75e4b6af4311def3c3d40ca5c0465cdbb13837b1aa97e848ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gallery-dl.exe
    "C:\Users\Admin\AppData\Local\Temp\gallery-dl.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\gallery-dl.exe
      "C:\Users\Admin\AppData\Local\Temp\gallery-dl.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4612

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\VCRUNTIME140.dll
        • Size 81KB
        • SHA256 e308b3b4f3d3c9285c0df2539fcd20372c39656b8f17d78811249287b4852880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_bz2.pyd
        • Size 76KB
        • SHA256 645665cf3338e7665e314f53fbbcb3c5d9174e90f3bf65ddbdc9c0cb24a5d40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_ctypes.pyd
        • Size 113KB
        • SHA256 d500cff28678eced1fc4b3aeabecc0f3b30de735fdefe90855536bc29fc2cb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_hashlib.pyd
        • Size 37KB
        • SHA256 02dd924d4ebfbb8b5b0b66b6e6bb2388fccdad64d0493854a5443018ad5d1543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_lzma.pyd
        • Size 154KB
        • SHA256 bfe6e288b2d93905f5cbb6d74e9c0fc37145b9225db6d1f00c0f69eb45afd051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_socket.pyd
        • Size 67KB
        • SHA256 62ed631a6ad09e96b4b6f4566c2afc710b3493795edee4cc14a9c9de88230648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_sqlite3.pyd
        • Size 67KB
        • SHA256 c222806d471a71d0fd804162e5da3dc607973367819453c20119a5742eff5113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_ssl.pyd
        • Size 139KB
        • SHA256 80041ce67e372f1b44b501334590c659154870286d423c19f005382039b79476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\base_library.zip
        • Size 762KB
        • SHA256 322555829db6af9ba1fab433a8c868219003efe0860a0a87242b98b0683c6bb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gallery-dl.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\gallery-dl.exe.manifest
        • Size 1KB
        • SHA256 50ea896d84de183b7e41df7f2c3cfc455c1db5ac1d54099fdff9569426dac201
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libcrypto-1_1.dll
        • Size 2.1MB
        • SHA256 3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libffi-7.dll
        • Size 28KB
        • SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libssl-1_1.dll
        • Size 525KB
        • SHA256 44a228b3646eb3575abd5cbcb079e018de11ca6b838a29e4391893de69e0cf4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python38.dll
        • Size 3.9MB
        • SHA256 79545f4f3a658865f510ab7df96516f660e6e18fe12cadaaec3002b51fc29ef6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\select.pyd
        • Size 23KB
        • SHA256 973f851dfaf98617b3eb6fa38befeb7ede49bd993408917e207dc7ea399de326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\sqlite3.dll
        • Size 1.1MB
        • SHA256 72045a1cbe25e35d8b8c3df1349c28137525c63ff5fc7e423af87940434f4cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\ucrtbase.dll
        • Size 880KB
        • SHA256 ab2bbec93fa2af707d9c55b3db442dde6561d1799e53e74c7f6345252989798c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download