Overview

overview

7

Static

static

3

de3a4b313b...d6.exe

windows10-2004-x64

7

de3a4b313b...d6.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    de3a4b313b3079bbf636f60d6310f4dc704b5e5927af2e27be4d74a66aebe1d6.exe
  • Size 14.2MB
  • Sample261002-2g6qlsxtcy
  • SHA256 de3a4b313b3079bbf636f60d6310f4dc704b5e5927af2e27be4d74a66aebe1d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de3a4b313b3079bbf636f60d6310f4dc704b5e5927af2e27be4d74a66aebe1d6.exe
    "C:\Users\Admin\AppData\Local\Temp\de3a4b313b3079bbf636f60d6310f4dc704b5e5927af2e27be4d74a66aebe1d6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\AppData\Local\Temp\de3a4b313b3079bbf636f60d6310f4dc704b5e5927af2e27be4d74a66aebe1d6.exe
      "C:\Users\Admin\AppData\Local\Temp\de3a4b313b3079bbf636f60d6310f4dc704b5e5927af2e27be4d74a66aebe1d6.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:1968
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:6140

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\VCRUNTIME140.dll
          • Size 121KB
          • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_bz2.pyd
          • Size 71KB
          • SHA256 8c7d753de57a8e834723c354c824a5fa0bd043bcb4c14e5e61602b24db5b7b66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_ctypes.pyd
          • Size 113KB
          • SHA256 ff71c3faf09cc9ffa2c6827318e0bdecaf9997fb2b34618f0175a34129af75ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_hashlib.pyd
          • Size 53KB
          • SHA256 3c52a95d424b5a3a991e074ba79eeb3079674203d88e1f65b387e78376d8e2e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_lzma.pyd
          • Size 149KB
          • SHA256 375b420d8fea75d285e0b717f1b4177dac8ba85d72ff3ba08dafe49a8ad333ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_queue.pyd
          • Size 20KB
          • SHA256 ee6add874282162168ffd487abbb1612e5f9e27dfbcc3aec6e1c2495dfee592e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_socket.pyd
          • Size 70KB
          • SHA256 5993b040fabd24473b89baee4d20a4a0c6d952c665a1e9274af9aca52d065b69
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_ssl.pyd
          • Size 161KB
          • SHA256 0bdd0f839fd8f3d15a1673f96522d0997074265e46f21c32bc5b36581a948ec4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_wmi.pyd
          • Size 25KB
          • SHA256 9b098fd682614f5d479dcff4ffe596fa6114cb7fcdccb5abda1b2df44726a409
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          runtime_en.json
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\assets\locales\runtime_en.json
          • Size 121KB
          • SHA256 94f4daef45ea309774eae165c3799765a9417fbc2d3e83b18d878d41ebef2f17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\base_library.zip
          • Size 1.3MB
          • SHA256 6ba34c26640fe0fa5ddff7f86b170b0d822d4456a98f843902042c7ee48e2848
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          METADATA
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\fluentytdl-3.7.6.dist-info\METADATA
          • Size 893B
          • SHA256 690cc272504b7654c9b2854694ca6a28f706eefa93b6b85b9cc4bfc2336c2182
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          libcrypto-3-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\libcrypto-3-x64.dll
          • Size 7.6MB
          • SHA256 4b55dfd2569794a04b88927230077dc8fe8d4f7149f52d363ba8403b6afba082
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\libffi-8.dll
          • Size 27KB
          • SHA256 29c82d52309314a7b7252cec2552554192f67b7dfa58716bb6980c0a93ac5144
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\libssl-3-x64.dll
          • Size 1.5MB
          • SHA256 d3d7b884ba9476130f9260a00e9c9447927830c9901cafd5362c1ab4ea185ac9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\python3.DLL
          • Size 55KB
          • SHA256 3a732a327059307c35e033b5d3f2008e07d3c9f28a1d871d1d834d7809bf0bd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\python312.dll
          • Size 6.7MB
          • SHA256 e3d09dc4129ab93f57bf9a30d7e16cdcb87e73cd27fbbc9377dd58275640e7e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\select.pyd
          • Size 18KB
          • SHA256 e6b95808f5fbd83099ec16e907b2c78e0635ce90f28ec622accdf900a142ee4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\ucrtbase.dll
          • Size 1.3MB
          • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download