Overview

overview

7

Static

static

3

MailRanger.exe

windows10-2004-x64

7

MailRanger.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MailRanger.exe
  • Size 39.6MB
  • Sample260928-sdblmaxwhx
  • SHA256 090a400f85935543d2d2097e88d4c82c11be639d5684a32829dcc695184c9ed6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 58 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MailRanger.exe
    "C:\Users\Admin\AppData\Local\Temp\MailRanger.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\MailRanger.exe
      "C:\Users\Admin\AppData\Local\Temp\MailRanger.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5048

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Cipher\_Salsa20.cp37-win32.pyd
        • Size 11KB
        • SHA256 9a536d35781669661a2bc87689cf2e08672c6f36524bf5d282e0fcb4f2f8e48c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cbc.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Cipher\_raw_cbc.cp37-win32.pyd
        • Size 10KB
        • SHA256 5b7fa0484b45e631217d99ef0e166a13ccaa58d345ad168fa00121fc067b0d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cfb.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Cipher\_raw_cfb.cp37-win32.pyd
        • Size 9KB
        • SHA256 c6d46257e6bd8cef397cbc2c08a34e0ac05db57e769942c52b219e96206a5cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ctr.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Cipher\_raw_ctr.cp37-win32.pyd
        • Size 10KB
        • SHA256 73e74b19989a2d9ca3d5cb7bd3bb4f3b2f6acda64548c2f755df7d912997854a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ecb.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Cipher\_raw_ecb.cp37-win32.pyd
        • Size 8KB
        • SHA256 f949420cc183f495b6f64cc84d401968d1352bb64f7c0a2292ed060cdccb5b92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ofb.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Cipher\_raw_ofb.cp37-win32.pyd
        • Size 9KB
        • SHA256 e36d5bf1bb443fb988f1763cd39c7268a8c6d804b8ac51f85a67c2874ab059d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _BLAKE2s.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Hash\_BLAKE2s.cp37-win32.pyd
        • Size 11KB
        • SHA256 9ed3ca525d9335793cb8e1bcf6419d4bf71113c1d310568a0bbc110c1837ca7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _MD5.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Hash\_MD5.cp37-win32.pyd
        • Size 12KB
        • SHA256 c3d23a66f09e08c640615e32f35599b55dcb1de072010815abb0f42317d41e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA1.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Hash\_SHA1.cp37-win32.pyd
        • Size 15KB
        • SHA256 6754fbd887390e489fe9cf54b88bbb998a025cd653536766e10f4c876f53f3ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA256.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Hash\_SHA256.cp37-win32.pyd
        • Size 17KB
        • SHA256 66bf675a8fae36fe3bd0c27532080f31d98b400f0bc9e93a407466a348725b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _strxor.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Crypto\Util\_strxor.cp37-win32.pyd
        • Size 8KB
        • SHA256 d2798c0500c642dfbb02202fab0922697b842bc3e68b6cf256956b3ff39f8044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\MSVCP140.dll
        • Size 451KB
        • SHA256 75ddc9778c23ee95b6c57db6b689f11c07d164d5a4c158d4c0acb87a520b8004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MailRanger.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\MailRanger.exe.manifest
        • Size 1KB
        • SHA256 0b10a57d018a1e52169ec4835fa94af6590c0b0d1b071a1104c13ea1659abe23
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\PyQt5\QtCore.pyd
        • Size 1.7MB
        • SHA256 26b1d740327c0b5b60276412f64c98981765011d5c1b06e086aa2c0a465744ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\PyQt5\QtGui.pyd
        • Size 1.8MB
        • SHA256 3202b0e3a483f57ff16612797a9076b427be83ed40268fcf99e13d4b67a9c79e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\PyQt5\QtWidgets.pyd
        • Size 3.6MB
        • SHA256 771914976f6de9637c0f0044f46bdcf6f0ef82ce5701aa8b9adcba66e5d67f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\PyQt5\sip.pyd
        • Size 84KB
        • SHA256 e88bb6a429ba10da20067505e1e0b113501057b43efe3ba85ffe60d69d1703fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Qt5Core.dll
        • Size 4.6MB
        • SHA256 1f1018bcaa98f5aadc024caea1ab7cf0cb77242b6b9cb562b08b33edfb9c0feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Qt5Gui.dll
        • Size 5.0MB
        • SHA256 438c2952f60fc45f6c5ede2aa71cf0ed8139767af544137b45f88c467f6cb444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\Qt5Widgets.dll
        • Size 4.2MB
        • SHA256 a5f842520a10173d6165b8652fd0ffddd6270b38de13e9c02acc6a8b775778b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\VCRUNTIME140.dll
        • Size 84KB
        • SHA256 1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\_bz2.pyd
        • Size 71KB
        • SHA256 befc81440bbc001bd7647aca42962ee0b45b08435ee9f7140bf570af636b7dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp37-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\_cffi_backend.cp37-win32.pyd
        • Size 131KB
        • SHA256 d44b2bd724589c63b8d66fae2557b920cb8885199a5ecf1aa438a90ed68cdbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\_ctypes.pyd
        • Size 105KB
        • SHA256 b016e7ce9744a0e8fea473f1982e5d2fc355a98682054f470f4189d5fc00b8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\_hashlib.pyd
        • Size 31KB
        • SHA256 c2b3dc92abd96485032d1287941e405d56df05fb5ba68199497d8594400163e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\_lzma.pyd
        • Size 181KB
        • SHA256 ab20e63d14259a7deca85a068796476c0efcc236a11d53b1816fc6f8956424a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\_socket.pyd
        • Size 65KB
        • SHA256 b7829ec5c6de17b30037e1b50f43e26b40fcd9acdabce0011d623f5c0cebd70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\base_library.zip
        • Size 767KB
        • SHA256 8418fa28b6daca980d076e7558e8f550e1413fcf65ab930068fad100e3a35a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\libcrypto-1_1.dll
        • Size 1.8MB
        • SHA256 3f70a63aacc024c4cd599ff1e12bf5b685719cf2b92c4420fd20ab032c9c898c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\pyexpat.pyd
        • Size 164KB
        • SHA256 40b17f3dff41e29492c8519372d435cd973f0a67597663fb12ad6756eaaa9077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\python3.dll
        • Size 57KB
        • SHA256 6b2ee6ed6617753c8859e3c6fc7af863843c6827045be9f233af8ae316418550
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python37.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\python37.dll
        • Size 3.5MB
        • SHA256 20cd780cf1e90778799e749812b00b1865938ef8990cd9bf2c1630787c6181c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10802\select.pyd
        • Size 22KB
        • SHA256 f8bf0c9909ee65038f5bfdb47c7ee037bf55c97d5be259aa904d4e53a9b5cd34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5048-377-0x0000000074230000-0x00000000745D8000-memory.dmp
        Download