Overview

overview

7

Static

static

3

Kirra_Antidote.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    5s
  • max time network
    9s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/09/2026, 23:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Kirra_Antidote.exe
  • Size 17.8MB
  • Sample260920-3vxkjaeb39
  • SHA256 fab5f2698028f1cf092253bdcb2f0eca23529d9060d7756867b8d93a27cebdc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 32 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kirra_Antidote.exe
    "C:\Users\Admin\AppData\Local\Temp\Kirra_Antidote.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5320
    • C:\Users\Admin\AppData\Local\Temp\Kirra_Antidote.exe
      C:\Users\Admin\AppData\Local\Temp\Kirra_Antidote.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:3872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Kirra_Antidote.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\Kirra_Antidote.dll
        • Size 39.7MB
        • SHA256 331f0fcf1011f036f2dbc26841d6311fffac88d6480abd13e705147de5b7d3be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_asyncio.pyd
        • Size 59KB
        • SHA256 a7aeee08236aad92515d40c2be7aa533fe434fb6b0653caf31f774b6985b1d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_bz2.pyd
        • Size 78KB
        • SHA256 d7faf016ef85fdbb6636f74fc17afc245530b1676ec56fc2cc756fe41cd7bf5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_cffi_backend.pyd
        • Size 175KB
        • SHA256 e029cabce12aea3d77f2c8709a0f4be695f3fedd1144c14607b4fcc3b9e9bc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_ctypes.pyd
        • Size 116KB
        • SHA256 0bd4ed11f2fb097f235b62eb26a00c0cb16815bbf90ab29f191af823a9fed8cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_decimal.pyd
        • Size 244KB
        • SHA256 fe2bccb2e204a736ed86a8d16effeafe83b30b44f809349e172142665de8458a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_hashlib.pyd
        • Size 58KB
        • SHA256 fa0bb4bf93a6739ce5ade6a7a69272bbc1227d09c7afc1c027d6cea41141bcc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_lzma.pyd
        • Size 150KB
        • SHA256 f904b02720b6498634fc045e3cc2a21c04505c6be81626fe99bdb7c12cc26dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_overlapped.pyd
        • Size 44KB
        • SHA256 4bb4ad9bcd89138669909efaaf6f344ad95f31015329351c94a8d4fdba71314c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_socket.pyd
        • Size 73KB
        • SHA256 f3e0e2f3e70ab142e7ce1a4d551c5623a3317fb398d359e3bd8e26d21847f707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_ssl.pyd
        • Size 152KB
        • SHA256 5860fe208122219a4071cc369d5001edc3b08c13bd96156abd1375e35401acd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_uuid.pyd
        • Size 20KB
        • SHA256 8f1c0151485055e65f174d779cfefd2fae601ca52f556ee3880e417ea6e43187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zoneinfo.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\_zoneinfo.pyd
        • Size 39KB
        • SHA256 6b5f9ea23299dc2a27a1381c77b5ec21955f40522c93db0bac02e82cd98e279d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\certifi\cacert.pem
        • Size 234KB
        • SHA256 9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.6MB
        • SHA256 6c69eb01deed404f8d16f4f23b176a1080745ea4b1c2dfd4c64e874e93782bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 17d0f4c13c213d261427ee186545b13ef0c67a99fe7ad12cd4d7c9ec83034ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\libssl-1_1.dll
        • Size 681KB
        • SHA256 a594fc6fa4851b3095279f6dc668272ee975e7e03b850da4945f49578abe48cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\multidict\_multidict.pyd
        • Size 80KB
        • SHA256 32e48f9dbeb227e1175b1f7edf71ee5565f08c2a8107cbfd3dcab4052b69d18b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\propcache\_helpers_c.pyd
        • Size 64KB
        • SHA256 7006016f3c45a789d096ba181ededec90901a1a880d70bed7e4c727a5abb1a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pydantic_core.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\pydantic_core\_pydantic_core.pyd
        • Size 4.9MB
        • SHA256 2761773befa62c8194bc1140701dfb37e38b63484766ee0c9b878bd9028fd80b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\python3.dll
        • Size 60KB
        • SHA256 70596aea8c5ca8f3bf88e46a0606522413b50208ec9fcc6b706f7a064cf83b79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\python310.dll
        • Size 4.2MB
        • SHA256 b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\select.pyd
        • Size 25KB
        • SHA256 1f56df23a36132f1e5be4484582c73081516bee67c25ef79beee01180c04c7f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\unicodedata.pyd
        • Size 1.1MB
        • SHA256 1ac171f51cc87f268617b4a635b2331d5991d987d32bb206dd4e38033449c052
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\vcruntime140.dll
        • Size 94KB
        • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        speedups.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\websockets\speedups.pyd
        • Size 11KB
        • SHA256 9a57ace5f1b503e9a6dc5be8d97a3947b4d50322c7fd91b3023e4c0d8b29b1a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\yarl\_quoting_c.pyd
        • Size 79KB
        • SHA256 09d31530118c73fa6a60dc8a7844c7da05249ad68508411dd257305023964898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backend_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5320_384812_cn8neQTUeLQ\zstandard\backend_c.pyd
        • Size 512KB
        • SHA256 bf99f3c9e6c4b9740ef512b37e95a514222bc5b500cf58a8582219b75624a761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3436-97-0x00007FF60BC60000-0x00007FF60CE5D000-memory.dmp
        Download

        memory/3436-99-0x0000022A76FF0000-0x0000022A7798A000-memory.dmp
        Download

        memory/3436-98-0x0000022A72730000-0x0000022A74FA3000-memory.dmp
        Download

        memory/5320-105-0x00007FF60BC60000-0x00007FF60CE5D000-memory.dmp
        Download

        memory/5320-106-0x00007FF60BC60000-0x00007FF60CE5D000-memory.dmp
        Download