Overview

overview

7

Static

static

3

auto_click...W).exe

windows10-2004-x64

7

auto_click...W).exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 06:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    auto_clicker(zh-TW).exe
  • Size 13.0MB
  • Sample260930-g72jcs1set
  • SHA256 2731ec852d3fb2d6da239978f376ffc94c86ac484b4521dfaef944388fd3fcae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\auto_clicker(zh-TW).exe
    "C:\Users\Admin\AppData\Local\Temp\auto_clicker(zh-TW).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\auto_clicker(zh-TW).exe
      "C:\Users\Admin\AppData\Local\Temp\auto_clicker(zh-TW).exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:3328
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1160

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\PIL\_imaging.cp310-win_amd64.pyd
        • Size 2.4MB
        • SHA256 7fa8aafb3e8b6771c95dcb5047b6d9ce194f7ed5ed1267ebf2774baf229b6f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_asyncio.pyd
        • Size 62KB
        • SHA256 97ed94f8d35445573177ba75e17dcf4c667e3c236c0b4d436fa97f8c862cc0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_bz2.pyd
        • Size 81KB
        • SHA256 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_ctypes.pyd
        • Size 120KB
        • SHA256 7adcea3a5568752a6050610cfbe791a4f8186aaaa002f916b88560a1ddab580f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_decimal.pyd
        • Size 242KB
        • SHA256 2bab2833c24eb4e07fe082d291013eed000a5cfc22df49311c729e7a57fe632e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_elementtree.pyd
        • Size 124KB
        • SHA256 0f35db36f3768bd096727c731aa76879650246d550c503af381cd96adee35258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_hashlib.pyd
        • Size 60KB
        • SHA256 23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_lzma.pyd
        • Size 154KB
        • SHA256 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_multiprocessing.pyd
        • Size 32KB
        • SHA256 b28e94b921d5d539cbd5f97ff4926e4f186791af1b364de7be7fcce3970172f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_overlapped.pyd
        • Size 47KB
        • SHA256 370b4ad06881c3cb781be0f78476eaeb5e440c60498f5791c3d413860fdc9b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_queue.pyd
        • Size 29KB
        • SHA256 24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_socket.pyd
        • Size 75KB
        • SHA256 71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_ssl.pyd
        • Size 155KB
        • SHA256 4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_tcl_data\auto.tcl
        • Size 21KB
        • SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_tcl_data\init.tcl
        • Size 25KB
        • SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_tcl_data\tclIndex
        • Size 5KB
        • SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_tk_data\tk.tcl
        • Size 23KB
        • SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\_tkinter.pyd
        • Size 63KB
        • SHA256 a6849cc7f7075924cbebe3000d6daa88d1724c1d869d6683a2bf9664cfb0e9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-core-file-l1-2-0.dll
        • Size 11KB
        • SHA256 77059cc0036311541ddb7f5182c0a3e81fd19f262de8306f84373e9b5b2854b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-core-file-l2-1-0.dll
        • Size 11KB
        • SHA256 380d5872d01f3bd52a5e9094f0f855db18306bd6215a02e134be970f0c0d9c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-core-localization-l1-2-0.dll
        • Size 13KB
        • SHA256 5ae2d370948811935300bf4ded67c21aab8137e1365c419b2c27d11e91dc591f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 11KB
        • SHA256 a2c259e61c4ec1bb7611ac23830588747dde103363bdc671cf91a2433afce283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-core-synch-l1-2-0.dll
        • Size 11KB
        • SHA256 004b008c23339b6ee651823d4ed6449d1d2f92a38e4e462104a389df1d0c863f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-core-timezone-l1-1-0.dll
        • Size 11KB
        • SHA256 ea0f6c20f03568641c01b4eddbd263a7122a2c61c88136085b3339cbce56c4c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-conio-l1-1-0.dll
        • Size 12KB
        • SHA256 f17517f46361328aebf52954dd1b9181df5a98cbdb2395701e3e73c4da7a7a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-convert-l1-1-0.dll
        • Size 15KB
        • SHA256 177e190aca8cc88c1ad1fa1f8848f9abcbbc24a5dfd046cfff06f72fff1a3566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-environment-l1-1-0.dll
        • Size 11KB
        • SHA256 fbd4bde83228c37de6043f36a98610fa4bb053355ead44a59d33a464ccdb9fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 13KB
        • SHA256 c31cfd12bd6c3da456bada513bb381d33ebb6980465ff0d586b24fe84719b50a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-heap-l1-1-0.dll
        • Size 12KB
        • SHA256 1fc7051de0d107ac25badb41bc6062bd3a67aaf5553b6256052c65e51b548df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-locale-l1-1-0.dll
        • Size 11KB
        • SHA256 860b4ebcf673ee4c389e0ff8f502f540fd1ce8b2614a9c16b7f65cdf5c2ae0f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-math-l1-1-0.dll
        • Size 20KB
        • SHA256 7aaf66c87221eaac91c50ec1368f4accd32b63970f0e826f7ffffb2c4306664b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-process-l1-1-0.dll
        • Size 12KB
        • SHA256 733d3c3856868107e5708c92e747aac6df968a4d072328a8e8f36425d0e81770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 15KB
        • SHA256 b27cfa62dc7a0a115b1593d6f4b0c90ae494505dab3cceeacc013e2135d25969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 17KB
        • SHA256 e1bd3f4b19a0c7e574673b88b12d819d97d503350ed280ce2204afbdd7c9bc5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-string-l1-1-0.dll
        • Size 17KB
        • SHA256 7e69bbbc6ef5072b6c8e17af5f842f9959bc12335ef61cc6398d18ec8e03c41d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-time-l1-1-0.dll
        • Size 13KB
        • SHA256 50cf24a5b850ab992431f98dfe208704e7bc07427f74dee9873d0146900d56f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\api-ms-win-crt-utility-l1-1-0.dll
        • Size 11KB
        • SHA256 33ca12e689203e92d20e1407169fce64f318ac327327e833061b4aad9bac9cab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\base_library.zip
        • Size 859KB
        • SHA256 fa05f5f142262e1aef3e8f98653026d711ea52347d2103dec6e4ce1ef1e5b9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\pyexpat.pyd
        • Size 193KB
        • SHA256 30eb08571a88165b84bc0783c3ffbf19e9d99c5634ab274c73a8ddca163cafda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\python310.dll
        • Size 4.3MB
        • SHA256 c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\select.pyd
        • Size 28KB
        • SHA256 8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\tcl86t.dll
        • Size 1.8MB
        • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\tk86t.dll
        • Size 1.5MB
        • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\ucrtbase.dll
        • Size 1021KB
        • SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47402\unicodedata.pyd
        • Size 1.1MB
        • SHA256 a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download