Overview

overview

7

Static

static

3

ransom.exe

windows10-2004-x64

7

ransom.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ransom.exe
  • Size 9.9MB
  • Sample261002-ratglayejf
  • SHA256 8f65322c2a50843e99dd934134dcdcd73004bfaa755a9bc1a744df76c97e765e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransom.exe
    "C:\Users\Admin\AppData\Local\Temp\ransom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\Users\Admin\AppData\Local\Temp\ransom.exe
      "C:\Users\Admin\AppData\Local\Temp\ransom.exe"
      2⤵
      • Loads dropped DLL
      PID:1044
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4308

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\VCRUNTIME140.dll
          • Size 121KB
          • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_bz2.pyd
          • Size 71KB
          • SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_ctypes.pyd
          • Size 116KB
          • SHA256 c10b0b0f800c1327cb627a342b9afc5960d436e9e08b02f5d6971da69e4722c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_decimal.pyd
          • Size 237KB
          • SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_hashlib.pyd
          • Size 52KB
          • SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_lzma.pyd
          • Size 149KB
          • SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_socket.pyd
          • Size 66KB
          • SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\_tkinter.pyd
          • Size 52KB
          • SHA256 2cc987f71fe6a28e8ca5fc1f14c26bd6efa59b36e91d52901c17a5e57c4f0b2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\base_library.zip
          • Size 1.4MB
          • SHA256 ece18eae648f77f48367cde9f35b7c5c8ccee8bc27b41e554157e83194613248
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\libcrypto-3-x64.dll
          • Size 7.6MB
          • SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\libffi-8.dll
          • Size 27KB
          • SHA256 d56b5e5aa064e35f9ae5d11d2f0833a591d946bc04b85e1772ddfa7c84eb33a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\python311.dll
          • Size 5.6MB
          • SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\select.pyd
          • Size 18KB
          • SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\tcl86t.dll
          • Size 1.8MB
          • SHA256 59488f67a8e75a5d51c7cb865436b5581fbb16014e9233b34db0c22bea6d4765
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\tk86t.dll
          • Size 1.5MB
          • SHA256 e9a5815ad39619e22d581b7124bbaa4192e701229956a2edbaffc0c420864561
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000001d42\unicodedata.pyd
          • Size 1.1MB
          • SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download