263b6b407282f30e31f38bc3bfe7a6104dbb7e64b6bab58710f4587b67810241

Analysis

user interaction
yes
max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tropical.exe
Size 46.0MB
Sample261002-vg8fwaef52
SHA256 263b6b407282f30e31f38bc3bfe7a6104dbb7e64b6bab58710f4587b67810241
MD5 8cef25837d9c6900294542a1dd6c8e78
SHA1 46133392bc0de0387c3494624528573f90db55bb
SHA512 e76475769746bb46438144eeb214c01fa9d45296ba145caf82272a2d467d6478acd2273ef65f39b2adbd3d5b9d17760acd6673b2c36d96f439db3f1b1d027022
SSDEEP 786432:GeWIqZLSOp1WrnC+lhsOwJOkdO2RJABOa/IauH6LNEYcDryzo7DI1469F:Ges4rCMhsO0NRIuH6RrckWDL6
TLSH
T1B5B733BED37331E9C843837146FB2CFAD9973C6C235D419AC4C4B1996A066DB6638293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3808	tropical.exe
3808	tropical.exe
3808	tropical.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	tropical.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	tropical.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	tropical.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	tropical.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	tropical.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	tropical.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3808	3372	tropical.exe	90

C:\Users\Admin\AppData\Local\Temp\tropical.exe
"C:\Users\Admin\AppData\Local\Temp\tropical.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\tropical.exe
  C:\Users\Admin\AppData\Local\Temp\tropical.exe
  2⤵
  - Loads dropped DLL
  PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3372_746516_rnCOMpuWgyY\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3372_746516_rnCOMpuWgyY\python311.dll
Size 5.5MB
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
SSDEEP 98304:JdHwQkq3AAtsPv3XXTVEspHBMp4SsPxQpe2bx:JdHwQkq3AMsPvHXSpAxQpe2V
TLSH
T1F2466B22726584A0C97B8076EA2F864BD7B27C505F20CB0B61A4B7992F33B531EDF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tropicaltxt.png

Path C:\Users\Admin\AppData\Local\Temp\onefile_3372_746516_rnCOMpuWgyY\ui\assets\tropicaltxt.png
Size 358KB
SHA256 b38d5329b77e384f31841cd46750ff4ab18b5d73221f601fbab9d6c9679ebbe1
MD5 4dc7063e9308a8e09de1b869be987af8
SHA1 e6a67f03e4e4311e2e33321f11354489f4e48cc7
SHA512 ed09bbc445455ac5da24793514497e73cd99cff336e8b0072a328a41f58a66b7cf829c20abc6f9f095ec17a437daf2cf44a317f9741c61d6e2425bed574998e5
SSDEEP 6144:svVTxOfMGf/exJreqA2m44Bu85+83oqQjLcg6QVnykCOj6I4PpHsTesB7mNF0BBX:kVTkflexJ6qV94T+83Nwt6QMkCRHsLQA
TLSH
T1FB742380C660BA4AFD699595E928F567AF32657F1153802086EDB17EBA0DC3ECC10C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velorin.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3372_746516_rnCOMpuWgyY\velorin.dll
Size 48.3MB
SHA256 9ed3b350ab1c85a454d6504a66c2ae712298229103c21b69ce6fe7b37e1adb5c
MD5 7c62016a85c09737902e94507d932d69
SHA1 c9e4609a4faca224c70fbe1fed18d5612cd7e18e
SHA512 3c8c1b17c0c5519d86baa0d1a3375d56a0a4960f709e792ba412811a1476978ba44a16ac9a4cb4104b201e5bfef7f49ff36dbd27d6a6c2a6a24048d2e04134f5
SSDEEP 393216:TcBMHh/3aoCjgTqe92pd8COojGpvBktT6Hbj0iD4qK:TcBMHh/3aoYge5pdlUviBEfxD4q
TLSH
T165B72913F1D25099D46AC979872F60B3A326BC4C813876D79F48DE643B52F10AA7EF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-195-0x00007FF61EE40000-0x00007FF621C6F000-memory.dmp

Download

memory/3808-101-0x00007FF61EE40000-0x00007FF621C6F000-memory.dmp

Download

memory/3808-102-0x00007FFF68890000-0x00007FFF6B97E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads