Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 21:49
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
launcher.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target launcher.exe
- Size 12.1MB
- Sample261001-1pc8latzew
- SHA256 ea4019ab31257d455e8ecb4bf211c0af1e275a5f42dfdc6cbe9b29847008119b
- MD5 15bf716409c9453307899afef571382a
- SHA1 2fed4ee83565f20bf14d0f413869cfa609ce534c
- SHA512 76a7eb035bb2bec382b72617c2d4546c36650c8f305d1824954c6cd3d1c74597541a92aaee302dca6eefc2130e05324e54b63762b79db0b46c37add66d7404d5
- SSDEEP 393216:jyMVxA0FAbL6nGCnGjOMwBWtddE2Mrem:jLVxpA36nGCnkOMwudE2Mym
- TLSH T177D63354BB9100B6F0F3833C98A21C71FBA9B85617B6B5C70AA285A13F435E6193F335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 18 IoCs
pid Process 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe 3452 launcher.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3856 wrote to memory of 3452 3856 launcher.exe 89
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_bz2.pyd
- Size 84KB
- SHA256 261545bd24f15a783fc0c82568b766a4ab569dde14507a81701cccf5293e6e54
- MD5 b18acc96186c2bb1ed0b3256374e4f83
- SHA1 e2eb7b2e642de5866b597533d100848d1e1d0644
- SHA512 aba2bb8052000bf57f2fbf9ba9859c2678c384ed046d71edc288cd168e288169003a9f7868c3263491c1073e633e4bb187ee0c68fb287f7d454428e406c12a44
- SSDEEP 1536:/TVAz72U4OBcir2QVSZZOhcKJsawo8YfsDPYJIqLVfyPs5i9LgfIL2F:7VAz6UAixQjOaSsamYkDPYJIqLVghs
- TLSH T1FF838F97A76471F6F9AF81B5D6800363E730BB560710A3AFB244C3453F12B81AF68369
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_cffi_backend.cp313-win_amd64.pyd
- Size 176KB
- SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
- MD5 8401e66257d7a7c03e2783b8adcee482
- SHA1 57f6a22162c76964675dfe35e79be229bd6e54e2
- SHA512 e868dd99b1a8f1d0d5f84af461573aae35f9e4433dd5710a23fb2f7b3f552405255e7ebd048b206412e80cf327d10f093c510befc335e4dc2461229f9fae36f6
- SSDEEP 3072:KBZr0elNwqlDYuhJsPXHDFYHuSQT9wPHeR4quOVstP7eBSTLEKXj25Mf78A+TVq:KTwqd8jFYHuSQxwPHROVQKBSTLrqg78Z
- TLSH T130046C5A329C11B6D5A2917886579B43E3B3B430171197CF01A0C7B62F1BBE67A7FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_ctypes.pyd
- Size 131KB
- SHA256 9d6dccb4cd84a44a107f9b06b91c0a44e85766d9bf4debb6abbde8fda7494c2c
- MD5 f75c30ccf8ecf05a2ba83cb06eeb354f
- SHA1 962545549964c61dfbd31ab7d52ed470f7c5a9d6
- SHA512 277f113ef07c02c83e7542899104cd8a1e626e84a7b9b0f9d68e8562ac6221413cfac14b84c5db5156bebe80381034273529abadaa01592b11c6d346cf95e24a
- SSDEEP 3072:/uZ3aSoXIGagR+lf/FTzy4JxXBUnFIqyPst:Gobqf/FTzyixRUnn
- TLSH T186D37E0B776800AADAA39178C533AF47EFB1B453161097CF02A4C59A2F637966E7F305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_hashlib.pyd
- Size 67KB
- SHA256 79a26289aef0d92545a082507c7021f10e219621d137cb726c4d0fbbfd4b46ae
- MD5 4949202690a7f755717b685a99e21092
- SHA1 42ad37b620d204a8fcd5bdb2c09609b43639d1ac
- SHA512 52172d67a60e79bec735c9b71ccf5c5b558c436391735256a4168a200911c0d7d09d22c86cf8fb75331afc02f9924c395ce1b28c9516c9e9207b9885a9da9894
- SSDEEP 1536:eqXn1yAu1lEAXfXEfcV5Tam96CAhIqvICyPs5i9rfIYzWS:z1w1uAcfcym96CAhIqvIQu
- TLSH T11E637C9596894092E92382B5C4A34F83FA75F3521711ABDFA2A8C0CD2F233C78777756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_lzma.pyd
- Size 155KB
- SHA256 ee224aacf5cf9c9974a1b842aac8d89d5d9b7eeebbf4d76619ae0ce4da8ecd96
- MD5 9b3c9bae696ae1f89846da9dbb44e5ec
- SHA1 91e21fdecb5080d083df18d62b1a44e24929b1e6
- SHA512 8150fd33a5a36fe6d541e2fe30c8b716f95eaa65d9355ed23ca40d269547697b21156a023381e5d3c7923bf878447bbc9888916ce51661010868a14e4231a60e
- SSDEEP 3072:DK1fxTOfpRnifp5/eNRFcznf59mNoB/ujJIq01Ht0:D6JTOjKsHShYOoj0y
- TLSH T1B8F35B86B794F0E5F7728C38D2624F57E6F5785A0320929A01CC936D2B1FB659E2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_socket.pyd
- Size 84KB
- SHA256 ccbd0f83df3784da08147b8e8765e28c978de28b5c0eddcfba5567b59d43fef9
- MD5 e9f0b7a679d712b0a5df1a55e02ff60a
- SHA1 7c1dca1be48a41344b8eb3a0dc29af3b1d3c60d2
- SHA512 3a68fd75a2055427f1674676c423ba9ac692daeac6379330c11313436fe264fe77b34a0c5884e22886564eb33defaeee04e1b3d17f56f9e45d9e15214a0c011d
- SSDEEP 1536:YFl/fFBFu9aBvtgYKyNEyJwbQlyJ+i+nzJQw4jxtN388ZFIqywcVyPs5i9hfIYv7:YFR1u9mvPEyJwbQlyJL+nzJQljxrxFIM
- TLSH T13E836B01A66040FAEB73D075C2639E63FB74B1C11395A35F0466C65A2F337C2AF7AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\_ssl.pyd
- Size 177KB
- SHA256 8d2f51fa1dc929073a2ad8d1c7c0c911e8f695870dcf4dda2846f4b75a7f77fb
- MD5 e1da7e7534206b6f2d3d025c847c9df6
- SHA1 74585fb3b0f1b46fd3f90d81d5c6bb3cbdc930d7
- SHA512 fd8ae255deb3d933e27da712f093d21f8d02c74e57b8044da9a9e8076a5710ea27409ecca4cea6b49f7f0ee9bb6f6a004311d7baa3ef5211452126bc3eee09b7
- SSDEEP 3072:S9fZJvjN6U2kGMlfz6CvcyMNdmI7IM/cbPuC/JeJIqL7Og:S9xJrEU2tqz6CviPssT
- TLSH T135047C47B5945AF7D813E4F9C1234903EBB0F1553312479E48D6E64A0F03B4AAEAAB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\base_library.zip
- Size 1.3MB
- SHA256 ef025fdfadbde4a5e776d5a34ebc62f88b4304632620e030cfac64c68ac603a2
- MD5 a32d703701b55a9dc251fa3dabf2b6a5
- SHA1 8c7ac06fc95d83b1f22b2f02cc6c6b227edf54a1
- SHA512 48d64c0195f704ef39c4bf12058a62c61f45a2abd526f0034edac40d836b96980511d363c8a5895c75efc2c64b891f66aaa4fd814999ef0f1dc51aa68bb217f3
- SSDEEP 12288:WL+D1tYzGSmg15tiMxwsE1djdTnTCi2cPPdxhYOwlUK0iW7WpI6G75fTuIva802J:KSXg1ZxwhdZ+5cPPdxhYOYpo7Wpc13
- TLSH T15B651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\cryptography\hazmat\bindings\_rust.pyd
- Size 9.4MB
- SHA256 1d4332a447cab13dec8e3a533ad579e0e562b79e40822c931f33769758fc7156
- MD5 78a9b43f7635ac4ca6df3192ed430555
- SHA1 dda0656357da9ff20015a9cbc75ecf860113fada
- SHA512 57ebe36035a01bd27c995bef314272ce1fb717a8acbf60e1d4cd121ea452d3b6d19bc17e0039fab74ba02de6917cf4508b38ff10f3cb319a512c6e8e838ae75d
- SSDEEP 98304:EYpGu1vtnEnZ9hVAGrqf5ONee5Dlr44o3lxhN9t5M+C2Cx:UNee5Dlr44o37Vt2Nf
- TLSH T129A65B29BAA950A9D86AC4B4C34756339B3134DA1B347AFF49D096B92F36FF0163D304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\libcrypto-3.dll
- Size 5.0MB
- SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
- MD5 6d0a1af0e9a539a749dd50add9c4c27b
- SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
- SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
- SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
- TLSH T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\libssl-3.dll
- Size 776KB
- SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
- MD5 08ce4a95de930fd27157c67117f9a613
- SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
- SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
- SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
- TLSH T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\python3.dll
- Size 70KB
- SHA256 76e7fd69a01081726308317d6e502721c2ba6792b48880dc1ef649c755788db7
- MD5 622a2889ebd3fac5dcd791f10fd11040
- SHA1 5590d644aada602bf0217d95a5510117d2c5f066
- SHA512 378781e85fab1405b6838a925cd136aaf76c74c58e7dc036a3159321cdbfbbb51fc970afc49b2f0fa8af39fcd2f23d966eb134aa666a2e022bb00042470e5abf
- SSDEEP 768:aQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxic:OotssyKcunV8P5FIqy0tyPs5i92fIkZ1
- TLSH T192633AC25B5BF8A2D6F669FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\python313.dll
- Size 5.9MB
- SHA256 e820bf024efd2b56bb2b82791e6b6ddc7303f070f8e72cba7637482a8a906238
- MD5 e60c200eeefd75110b5801b150f9ff53
- SHA1 6e3a63bf17c7c8c4cafe51fb648e4dd767220139
- SHA512 b59cda63fce21d571510e373523b7dd4aae18a8f005fe9de39c4f2d66920f37f4d857d4781d43dc141485884a77a2b7d0ce45610e3105fdd7d91296ff09caea2
- SSDEEP 98304:XHoJQujBS7z5bCwCG/ytJ1Lff7rexvCHDMiEfVc7Sz1:XHoJQqUn5bCpfWi2c+z1
- TLSH T13D567C16729E41ACD97B8078CA07864BF7B27C053E60834B61E6BB5D2FB3362476E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\select.pyd
- Size 32KB
- SHA256 024f955349fe46cf1bb2c22c6b57fcf38cf5755d46166fbf63e7e5b92433b111
- MD5 bf9f0f5d76c5676e46a1163ca0ba9498
- SHA1 9da39e5b883457c7d7cbeaa6e9bb8a4a81161575
- SHA512 a99332dc9786243f06dfc6bfe6a2b7a1290a2e185eedb76da7dbd63b4a6e6a8ad7116a11a6de85253ec80f1446d5ca5190ac40f5c0efc1944133ea6ccd428887
- SSDEEP 768:PpX5FZnl8TaPFIq9GWyPsSvPuBL2Ip4zTxf1mlIJMlgPc:RX5F5l8aPFIq9GWyPs5i9RfIkMuc
- TLSH T112E28ECB6B285087EA63C631C5A1DE43F939B3E35621869F30B991C90E177C1A737258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000f102\ucrtbase.dll
- Size 1.3MB
- SHA256 5c52e3a303baaac0e0af8bd9b96134993da34bc9d834a31ef37e1d2cdc7fe192
- MD5 d23cd3544cf84fa579ad9f193ae507cd
- SHA1 c17223d624ceefc514789bfbb302fd3d511625bf
- SHA512 9e81b87e50bb7564c92ec511ddab4d979ab2f4382b2a10cccb155dfd3d0630bd70f7b5bdb1945984616b3bac393d44bd3504ac8313aa1d95671580c9507ad578
- SSDEEP 24576:CbMt2JyFA5B+48nhlMcuMmS9XFFr7xCqtYSoKYsbMDmxvSZX0yp9pWe4:qMt2JyFA5B+48nXpuMmS9rIqWjKGDpWT
- TLSH T1D455AE2166AD01E9C5BFE13DDA4B4A06D5B2781503709BCB03E94E792E3BBE5137B321
- MD5 SHA1 SHA512 SSDEEP TLSH