Overview

overview

7

Static

static

3

19ca83e81f...54.exe

windows10-2004-x64

7

19ca83e81f...54.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 08:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54.exe
  • Size 13.1MB
  • Sample260922-kpvvmsca48
  • SHA256 19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54.exe
    "C:\Users\Admin\AppData\Local\Temp\19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54.exe
      C:\Users\Admin\AppData\Local\Temp\19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5828

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
        • Size 77KB
        • SHA256 82a85187faf8786216c82ac1c4ccf32c8839048e242025ed4e7a1e3ab870255f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 114KB
        • SHA256 3a94a3525b0531524aabc7f8fc9f1253894cd612a9823d9cdd5070ab81b9d329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
        • Size 38KB
        • SHA256 8929b5818aaa0f595b8cc3b6aaddc630f2b27bcde3a29d44c13d95037596aa1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
        • Size 155KB
        • SHA256 d3350ad957d6c37b2c75f56a5a149f0eeb58295227f78c15048669a2e816ae3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 68KB
        • SHA256 48f1f1842e6845a197c9be50027bb2a67a868e743bfa81b8d8753c24cdc08b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
        • Size 140KB
        • SHA256 5dc85dd0bee9ef96c1f278398cc7af36de2f3721dce726a4b13d64bd63eabc39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
        • Size 2.1MB
        • SHA256 1e95a63b165672accde92a9c9f8b9052c8f6357344f1376af9f916aeeb306da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll
        • Size 28KB
        • SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
        • Size 526KB
        • SHA256 06958c63049e2d7fe1f56df3767e884023a76bba1f41319f7fab3439b28174c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
        • Size 1.0MB
        • SHA256 af602c6033875478b8cec6270c4b0fa618290b97c7e139d71dbb58b83a08781a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1184_134345404458593307\VCRUNTIME140.dll
        • Size 74KB
        • SHA256 9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1184_134345404458593307\main.dll
        • Size 4.7MB
        • SHA256 afe2881b2ad03ee417cf0f1673326ad371337a0d4eacba0ec40d1102582ab55b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1184_134345404458593307\python38.dll
        • Size 3.9MB
        • SHA256 a9675a91d767095c9d4a2ae1df6e17bdb59102dbd2b4504c3493b0bcbed5ef55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1184_134345404458593307\select.pyd
        • Size 24KB
        • SHA256 6d5a3630570035555cea342c3a8e2922ca23451113cb178cd7fee07e59da123c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1184-42-0x0000000000A90000-0x00000000017D5000-memory.dmp
        Download

        memory/5828-44-0x0000000074670000-0x0000000074B30000-memory.dmp
        Download

        memory/5828-43-0x0000000000A90000-0x00000000017D5000-memory.dmp
        Download