Overview

overview

7

Static

static

3

Switch2Con...10.exe

windows10-2004-x64

7

Switch2Con...10.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/09/2026, 19:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Switch2Connect_v2.10.exe
  • Size 98.3MB
  • Sample260912-xnylcsgc79
  • SHA256 ec8b5c384d6cea3ec20e5764730eb4ceb1c6713dd41aedcbf05578baf96d18d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 54 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Switch2Connect_v2.10.exe
    "C:\Users\Admin\AppData\Local\Temp\Switch2Connect_v2.10.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Users\Admin\AppData\Local\Temp\Switch2Connect_v2.10.exe
      "C:\Users\Admin\AppData\Local\Temp\Switch2Connect_v2.10.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:4428
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2712
      • C:\Windows\SYSTEM32\pnputil.exe
        pnputil /enum-drivers
        3⤵
          PID:2676
        • C:\Windows\SYSTEM32\pnputil.exe
          pnputil /enum-drivers
          3⤵
            PID:3940
          • C:\Windows\SYSTEM32\pnputil.exe
            pnputil /enum-drivers
            3⤵
              PID:1224
            • C:\Windows\SYSTEM32\pnputil.exe
              pnputil /enum-drivers
              3⤵
                PID:4596

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinUHid.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\WinUHid.dll
                • Size 108KB
                • SHA256 4678ba3acf80a0d7a3857f93a4400ca02742b56789bec34a8f575cc776053fb4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _asyncio.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_asyncio.pyd
                • Size 72KB
                • SHA256 e79dcc4ee292a9b93143674c3509743ef0496fd32e53c55b93f13cc402f815e5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_bz2.pyd
                • Size 84KB
                • SHA256 0ec5bdf4c688c1d2bda00f61e1f9e1369188c1019173a5412981f6569a997347
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _cffi_backend.cp312-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_cffi_backend.cp312-win_amd64.pyd
                • Size 177KB
                • SHA256 53de34afc3939d81bf2498b77425c52e2c3f3164f8cfe2543d3acc8f24134488
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_ctypes.pyd
                • Size 124KB
                • SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _decimal.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_decimal.pyd
                • Size 253KB
                • SHA256 b6edd193dc93d61846be47addd36655aaaf6749ea0409564d04bee6f785ffa15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _elementtree.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_elementtree.pyd
                • Size 131KB
                • SHA256 9b72b42c3fa741025d760db945d47f948271c884e61e5cbfb94f1c99b0446636
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_hashlib.pyd
                • Size 65KB
                • SHA256 dfacbb48ade3d53780ff1e6875da90930a4a5d593e21984779079bd6f98f3768
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_lzma.pyd
                • Size 156KB
                • SHA256 ed997ca4956fe7e27cc702adaa8d31136312361d285b7b845c8829d8c5a89ae8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _multiprocessing.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_multiprocessing.pyd
                • Size 36KB
                • SHA256 4616e0b5d2780f30584d031fbef4dea7a1b364aa3dc7a260c0dc02d19cb7cee3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _overlapped.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_overlapped.pyd
                • Size 56KB
                • SHA256 2c0f17ea5ae1a9f8c1c7d4da1c0cd7d077864174b33bb65a479bdf5e76248d3b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _queue.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_queue.pyd
                • Size 32KB
                • SHA256 eb4070d87384565985a59a7139e0903b120044059cb0934a9a425c360e93a34c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_socket.pyd
                • Size 83KB
                • SHA256 961dc7c65a28c174688e2f6b7803a615b9c034849a17cfc6527a27ccb2eeadb0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ssl.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_ssl.pyd
                • Size 174KB
                • SHA256 78728b5e06037e3adfe922b59bb1dd19dea391e9ca02e21caab3cdc832111036
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cp1252.enc
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_tcl_data\encoding\cp1252.enc
                • Size 1KB
                • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                _tkinter.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_tkinter.pyd
                • Size 66KB
                • SHA256 dee33016c5042c68694975f72f0b44a7be7c8f49390155334f331b9fd624d58e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _uuid.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_uuid.pyd
                • Size 26KB
                • SHA256 31c83cb8c5e3eb397252fe871c74fb163d90b88c9e7ac7fd689eeba88c0dd92e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\_wmi.pyd
                • Size 38KB
                • SHA256 4f6361517b4e127642d4e641ddbfa060b3d32da8ac7fc7a35a51c02680933084
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\base_library.zip
                • Size 1.3MB
                • SHA256 bddc2586c5c6deca1e6de2bfd39d0ee76453d36fc03f2e5bf94d2aff7c456422
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _msbt.cp312-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\bluetooth\_msbt.cp312-win_amd64.pyd
                • Size 26KB
                • SHA256 b550b4fa9ec8ebbf5951b7462f93b33b6ca29a9c6ffd5f0406d33379a76f92f9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                partition-table.bin
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\drivers\esp32s3\firmware\v5.9\tinyusb_direct\partition-table.bin
                • Size 3KB
                • SHA256 7f00b6c042a89b15b0cac534f82ed988caf29278ff5700b0c511eb1b5bb7c820
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                hid.cp312-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\hid.cp312-win_amd64.pyd
                • Size 119KB
                • SHA256 c980398e0e25c01226d907b98d45216c9f59d67ffe61b75526be000c617e99ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                INSTALLER
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\imufusion-1.2.11.dist-info\INSTALLER
                • Size 4B
                • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                • MD5 SHA1 SHA512
                Submit Download

                imufusion.cp312-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\imufusion.cp312-win_amd64.pyd
                • Size 33KB
                • SHA256 f44ba3660b99265ee3478c190e1e6e698fa46597f5fa3af78a9f15e0a7c29e24
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libssl-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\libssl-3.dll
                • Size 774KB
                • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libusb-1.0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\libusb-1.0.dll
                • Size 162KB
                • SHA256 62ccefaf3f99dc46f6739f803391958cf77c8bc9cb5cf44acda8512709a404db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pyexpat.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\pyexpat.pyd
                • Size 199KB
                • SHA256 6b4f77625a28693032ae629d8c4bc49a4d05a5362ff8c2d03eaa3dded554bcb0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\python3.dll
                • Size 68KB
                • SHA256 e6811bc64d0cc2a8525098b691db364679602c7456894c2f69e1837214a8a705
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python312.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\python312.dll
                • Size 6.6MB
                • SHA256 b6227a506a9963e7c8182785a54e14a193af51f7b277a61dda04492b499f49ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\select.pyd
                • Size 32KB
                • SHA256 e6bff4f35ab49a84f9e5ccd4b26eff30e1b2d7adb67d91911c4b84bfabcc28b3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tcl86t.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\tcl86t.dll
                • Size 1.8MB
                • SHA256 78bcefcd0bfdd38651da285b8ce529b2f6bac35b2227f6095053dc458f92f4d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tk86t.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\tk86t.dll
                • Size 1.5MB
                • SHA256 c9ac8496db4cb9b518761144a6ecffdcf845f969809e768458ef59f40b967b62
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\unicodedata.pyd
                • Size 1.1MB
                • SHA256 a443f6132d63a683ea3ef463cfe00987e0cf94d02c9e14350795f1a521d05f50
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WHEEL
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\winrt_windows_devices_bluetooth_genericattributeprofile-3.2.1.dist-info\WHEEL
                • Size 101B
                • SHA256 f143fdc7da6e588d0fd55fddecada831306a7de2cd9b6d424f367f3edaf43575
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                top_level.txt
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\winrt_windows_devices_enumeration-3.2.1.dist-info\top_level.txt
                • Size 6B
                • SHA256 073c106f875946dd0dc425e2d740118d6b28c7b02c9ad7ff957af0fca47e0ff1
                • MD5 SHA1 SHA512
                Submit Download

                _yaml.cp312-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\yaml\_yaml.cp312-win_amd64.pyd
                • Size 257KB
                • SHA256 071edefcb110c7b727775fc0f7f9c2969dd7efb83efcbc356a8000b5865bc169
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                zlib1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33282\zlib1.dll
                • Size 143KB
                • SHA256 65fc0898d45dd25627a4cd9b14e5d2a8937a99c3059cefc5536edb1591733b26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                config.yaml
                • Path C:\Users\Admin\AppData\Local\Temp\config.yaml
                • Size 132KB
                • SHA256 bc7960cae737c522993402e02088f9a80110f44d988779f6d30830b4abee799f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4428-1621-0x00007FFD3AC90000-0x00007FFD3ACB9000-memory.dmp
                Download