Overview

overview

8

Static

static

3

Kirra_Spam.exe

windows10-2004-x64

8

Kirra_Spam.exe

windows11-ltsc_2024-x64

8

Kirra_Sweep.exe

windows10-2004-x64

7

Kirra_Sweep.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    143s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 18:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Kirra_Spam.exe
  • Size 23.4MB
  • Sample260916-xffetavakb
  • SHA256 6ab089ce9b2653f704fea49aa79572c0e7285d99a3dd1f4efb0de0a37fe46e5d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecution

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Loads dropped DLL 52 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kirra_Spam.exe
    "C:\Users\Admin\AppData\Local\Temp\Kirra_Spam.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\Kirra_Spam.exe
      C:\Users\Admin\AppData\Local\Temp\Kirra_Spam.exe
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Kirra_Spam.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\Kirra_Spam.dll
        • Size 21.3MB
        • SHA256 fea8cde7bfc5aec413057ffcadf033c0be63a791815767e7d0ee88d956c3d572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\_bz2.pyd
        • Size 78KB
        • SHA256 d7faf016ef85fdbb6636f74fc17afc245530b1676ec56fc2cc756fe41cd7bf5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\_ctypes.pyd
        • Size 116KB
        • SHA256 0bd4ed11f2fb097f235b62eb26a00c0cb16815bbf90ab29f191af823a9fed8cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\_hashlib.pyd
        • Size 58KB
        • SHA256 fa0bb4bf93a6739ce5ade6a7a69272bbc1227d09c7afc1c027d6cea41141bcc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\_lzma.pyd
        • Size 150KB
        • SHA256 f904b02720b6498634fc045e3cc2a21c04505c6be81626fe99bdb7c12cc26dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 17d0f4c13c213d261427ee186545b13ef0c67a99fe7ad12cd4d7c9ec83034ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_image.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\SDL2_image.dll
        • Size 122KB
        • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\base.pyd
        • Size 30KB
        • SHA256 9f3411b241e871059449f02b8b89851d29177c0e922e88214eeb88d152f83bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bufferproxy.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\bufferproxy.pyd
        • Size 18KB
        • SHA256 2799a4a514674d86d4ba5c40e266e065d70436a22259d4ae2f4cf9439bb52ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        color.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\color.pyd
        • Size 34KB
        • SHA256 a45722fabbc61277280a2beeedb6ab560914addb931e5e8a97a047f5f514822d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\constants.pyd
        • Size 49KB
        • SHA256 ea949477aa7c9470ae4893c724c08539694e0c3f26ca97f1f65c64315941b1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        display.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\display.pyd
        • Size 43KB
        • SHA256 714895054fb908f4322ab5e44c870bc9188981b7b59929f730bbd1176f8d2557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        draw.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\draw.pyd
        • Size 49KB
        • SHA256 4931024acee3572dfa6c4f00ca7515035bf5aa1d7b1d15df1e1bb090f5479e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\event.pyd
        • Size 43KB
        • SHA256 32cb269746301252cc424e2794733b0e035bc5abc6e01e11e23c03320b9570ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        image.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\image.pyd
        • Size 29KB
        • SHA256 778383ffa0bf8101b5bc76db9ac9975e6de3cc796030156a7d669c7fa6aefa62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        imageext.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\imageext.pyd
        • Size 17KB
        • SHA256 8024ef2db089f872e70ef851709cfd779f7178f17fe6beceb3f787ed9d310274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        joystick.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\joystick.pyd
        • Size 20KB
        • SHA256 9810b9133abf683c2c23251cbbea43ed7761573089ebb6dc1d0a24c359d10941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        key.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\key.pyd
        • Size 20KB
        • SHA256 3335321fd01b8ec76464801f6acf334f153d8518656ecb70af8f5973896a04f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng16-16.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\libpng16-16.dll
        • Size 206KB
        • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\mask.pyd
        • Size 54KB
        • SHA256 96990b9c346225f991f8876a55bbb822f198ec2a751fd3121a1537329b24b2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        math.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\math.pyd
        • Size 74KB
        • SHA256 8076b21df2a2f91704bdc268d87cad4b9c8d223c08eeea29d12cfa700e267850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mouse.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\mouse.pyd
        • Size 19KB
        • SHA256 f6154780d0448c322742042b1af57e98c7954decc1e59d1a19d880d526ccc132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rect.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\rect.pyd
        • Size 45KB
        • SHA256 5c7ac0832ce0f51389ec11c68c9da22987917a5070b60d67f5f3037f6a5ab747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rwobject.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\rwobject.pyd
        • Size 19KB
        • SHA256 787dec284e90d9929402c4ad0003fb206351df5b457dbcd28a45b1105c6c359b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surface.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\surface.pyd
        • Size 234KB
        • SHA256 0434bc95b3e4870b75e3a520c55e2faad87d5a52b69a8583d947818e664a2718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surflock.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\surflock.pyd
        • Size 13KB
        • SHA256 df8b1b8ffae356df88284e2ca4b019cf2f2a10ab14cd38be483deb4e98ac6c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        time.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\time.pyd
        • Size 18KB
        • SHA256 bce9b336ee249c590a262a089f3e919a8dab1788c1ccf4b0a20ccc758ed9d2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\pygame\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\python310.dll
        • Size 4.2MB
        • SHA256 b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2936_545002_oJ__ZTMpZcw\vcruntime140.dll
        • Size 94KB
        • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/548-202-0x00007FFCF4B60000-0x00007FFCF4DCC000-memory.dmp
        Download

        memory/548-248-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-194-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-197-0x000000006A880000-0x000000006A8A7000-memory.dmp
        Download

        memory/548-196-0x0000000068B40000-0x0000000068B7C000-memory.dmp
        Download

        memory/548-195-0x00007FFCF4B60000-0x00007FFCF4DCC000-memory.dmp
        Download

        memory/548-193-0x00007FF6AEBF0000-0x00007FF6B037D000-memory.dmp
        Download

        memory/548-296-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-201-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-209-0x00007FFCF4B60000-0x00007FFCF4DCC000-memory.dmp
        Download

        memory/548-213-0x0000000069A00000-0x0000000069A44000-memory.dmp
        Download

        memory/548-211-0x000000006A880000-0x000000006A8A7000-memory.dmp
        Download

        memory/548-208-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-217-0x00007FFCF4B60000-0x00007FFCF4DCC000-memory.dmp
        Download

        memory/548-216-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-225-0x00007FFCF4B60000-0x00007FFCF4DCC000-memory.dmp
        Download

        memory/548-224-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-232-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-240-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-198-0x0000000062E80000-0x0000000062EA4000-memory.dmp
        Download

        memory/548-256-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-264-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-272-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-280-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-288-0x00007FFCF5570000-0x00007FFCF6B04000-memory.dmp
        Download

        memory/548-297-0x00007FFCF4B60000-0x00007FFCF4DCC000-memory.dmp
        Download

        memory/2936-192-0x00007FF6AEBF0000-0x00007FF6B037D000-memory.dmp
        Download