Overview

overview

7

Static

static

3

mitamers.exe

windows10-2004-x64

7

mitamers.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    139s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 17:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    mitamers.exe
  • Size 24.2MB
  • Sample260909-wfcs9azyhs
  • SHA256 f7aff80a95d80c244630b1ecc384a091aebfb0430b344e0c82c76d2538c3ffc4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mitamers.exe
    "C:\Users\Admin\AppData\Local\Temp\mitamers.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4184
    • C:\Users\Admin\AppData\Local\Temp\mitamers.exe
      C:\Users\Admin\AppData\Local\Temp\mitamers.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5208
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4332

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _cpuid_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Util\_cpuid_c.pyd
          • Size 10KB
          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
          • Size 81KB
          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
          • Size 62KB
          • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
          • Size 155KB
          • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
          • Size 233KB
          • SHA256 16be3f6feb15408195dcfe3aa1a75ef9db72f646b96ebbefdc68f56255f799f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\cd.pyd
          • Size 10KB
          • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
          • Size 686KB
          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32security.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32security.pyd
          • Size 132KB
          • SHA256 351632cb9bc00d96da46c975d3c396e4851488c814b4660ba35e9c6787528469
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          81d243bd2c585b0f4821__mypyc.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\81d243bd2c585b0f4821__mypyc.pyd
          • Size 211KB
          • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\Crypto\Cipher\_raw_aes.pyd
          • Size 34KB
          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aesni.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\Crypto\Cipher\_raw_aesni.pyd
          • Size 15KB
          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\VCRUNTIME140.dll
          • Size 96KB
          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\_cffi_backend.pyd
          • Size 174KB
          • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\_ctypes.pyd
          • Size 120KB
          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\_lzma.pyd
          • Size 154KB
          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\_queue.pyd
          • Size 30KB
          • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\_socket.pyd
          • Size 76KB
          • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\_uuid.pyd
          • Size 23KB
          • SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\libffi-8.dll
          • Size 34KB
          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sodium.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\nacl\_sodium.pyd
          • Size 396KB
          • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\python3.dll
          • Size 64KB
          • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\python311.dll
          • Size 5.5MB
          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312lib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\python312lib.dll
          • Size 33.0MB
          • SHA256 e98152afca94227b89311a7f073b712d2edd1b3e58d5fe224a4108936aef1b01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\pywintypes311.dll
          • Size 132KB
          • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\select.pyd
          • Size 28KB
          • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4184_134334498984843093\vcruntime140_1.dll
          • Size 37KB
          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download