Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 07:25
Behavioral task
behavioral1
Sample
57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe
- Size 8.2MB
- Sample260909-h847batcqa
- SHA256 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9
- MD5 47cba68ea0202632467e1ebedc5399c9
- SHA1 127a3604fc34652595f5f372e858086d1a31c50a
- SHA512 0fada82ad5d0d1b2bbb2dc863ce6b6c68ed72e78a41ff966a9af988f65e0f91fb6a62670dbd8a91dca5eed960fc4684a155845a219824b6b09958bae348f597a
- SSDEEP 196608:SBThfXtbW897G9r1LDsBTG9WdEWQ3P/R6:sfX1U3sB1KWQ/A
- TLSH T132863354737010E9F9B3963F9A55D09263B2B8228B60C6DF07B84A9A3E173F25D3D748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 16 IoCs
pid Process 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 5140 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4992 wrote to memory of 5140 4992 57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe"C:\Users\Admin\AppData\Local\Temp\57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe"C:\Users\Admin\AppData\Local\Temp\57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9.exe"2⤵
- Loads dropped DLL
PID:5140
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3456
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_bz2.pyd
- Size 85KB
- SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
- MD5 94fd94a3194ef83be4437755a14cb810
- SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
- SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
- SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
- TLSH T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_ctypes.pyd
- Size 138KB
- SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
- MD5 5860d45269a360d830807497fda7dd50
- SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
- SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
- SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
- TLSH T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_hashlib.pyd
- Size 67KB
- SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
- MD5 d60cc3d94442491b3f8657d54225198f
- SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
- SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
- SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
- TLSH T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_lzma.pyd
- Size 157KB
- SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
- MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
- SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
- SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
- SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
- TLSH T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_socket.pyd
- Size 85KB
- SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
- MD5 b042a4ce17bb4174ee2a927746f13f97
- SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
- SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
- SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
- TLSH T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_ssl.pyd
- Size 179KB
- SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
- MD5 0e79667c70090d09216d6a84f9c81273
- SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
- SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
- SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
- TLSH T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_uuid.pyd
- Size 27KB
- SHA256 2f141001cc496ff2f462e5247276d16a4f92ff741c75c81ed4e12e16ad859b10
- MD5 50ba1caec8183d268119eaad1077fc59
- SHA1 5f407f7331862e5decdd6f57b65db847e2177bb8
- SHA512 fde3ae51477672523757b2705d5a225d1544a03afdfdcc13c88d65ef4ac705ca21dd6eae771b10ba278e522afdc031e3a9a6380349f81cbfe6a75b7e12312101
- SSDEEP 768:zLMV25cwIMIwuo8y++RYT2Ip4wam9Txf1mltPRVGgN:zLMV25cwIMIwL8y+kR9waYfIZRcU
- TLSH T186D23CCAAA744153FA539B70D1E2DE43F939BBD35A11879B317A81850E133C1A32B36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_wmi.pyd
- Size 39KB
- SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
- MD5 d1eca38c5e1e76abe6a5eb862767e009
- SHA1 021b3fd3b5f7bf3c236832283c95f6fa979e565d
- SHA512 08945a1c25f7271e5793fb4706b896471e51cb2723a816e78115db3eee1d3b820cd7817fd7e524ecae9e0e72a8973469c127cda26c87ba3441abfa00cd7d932b
- SSDEEP 768:n2/EEqrVmjsGuN6S9VVwIM3i7Vo8y++RYT2Ip48Txf1mlDeI6JSU:yE9BE2N6S9VVwIM3ie8y+kR9wfIUJH
- TLSH T1DA037EC9E6680052EA57CA70C5A5CE53F635BB932711938F326982991F333D1E73A339
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_zstd.pyd
- Size 491KB
- SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
- MD5 11e408a51564f9626db73bb282aeeefb
- SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
- SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
- SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
- TLSH T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\base_library.zip
- Size 1.3MB
- SHA256 052b70d84b84a5fdd1a2ee8bc0c7cf77f09f71588dc6573cd22e75319b647189
- MD5 e1ff18032793cf665650fa01963378ab
- SHA1 c4a823de67f9138dc33fd11726c574aa99da5dde
- SHA512 d7474976581101592e45b39e9ef6f72cb9f6a241d168922016f2aa2ee157741bc217678b37471cebc1e3408f779c8376f60fc85c557318027572f8442c985abc
- SSDEEP 24576:CkJdmGuOdpLnuUFg7lbWRavQeOdP2m2dfx3:/9uOdFuUF1Rs/N
- TLSH T131552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libcrypto-3.dll
- Size 5.0MB
- SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
- MD5 8e8f32ae40518478e44269cf22cf4399
- SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
- SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
- SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
- TLSH T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libssl-3.dll
- Size 776KB
- SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
- MD5 f31ed8154564b75e48f2525a7e9f5742
- SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
- SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
- SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
- TLSH T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\python314.dll
- Size 6.4MB
- SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
- MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
- SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
- SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
- SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
- TLSH T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\unicodedata.pyd
- Size 740KB
- SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
- MD5 62a8f384eff5516c5941261b8b8c9fd5
- SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
- SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
- SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
- TLSH T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
- MD5 SHA1 SHA512 SSDEEP TLSH