Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 17:25
Behavioral task
behavioral1
Sample
NexusCode.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NexusCode.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
NexusCode_v6_features.pyc
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
NexusCode_v6_features.pyc
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target NexusCode.exe
- Size 13.5MB
- Sample261002-vzshdatv2j
- SHA256 291352cc13334cf825d8c089bec92e393626adcbcb07f0d1ba36f6c7964df834
- MD5 8975dc0e488948b3988590bffafaf73c
- SHA1 1ba31ca73e685d01bc3aadb6bd38b91398724f90
- SHA512 cbb7148d6c1112d030e399bcf3c4d07e61995fd92acf97a1a71417ecc097e7ca21bde9ed59a06e69b645fd2089852b27165be99e544bfab4b007d5cf11e59498
- SSDEEP 393216:SAVFyjPZE34J0OnGmIFFXWW5zmXVKLOuMvz:SAC+O+vTm8LOLvz
- TLSH T100E63398E3D091EBECB7903C89E7E542C262F5138762F6EB17944B661E331D48E39325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 15 IoCs
pid Process 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe 4552 NexusCode.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5396 wrote to memory of 4552 5396 NexusCode.exe 90
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\_bz2.pyd
- Size 85KB
- SHA256 b02f580daa0b390b2228d2a8186ef119be658c89cc64d0bd909550786ed993f2
- MD5 2301264d99e1f699ad99277198e33f60
- SHA1 3b5faaf13c5d41f7bf0cfa3133b109a275c71a1e
- SHA512 9521c78475bb769ae7da6c32b65076524868606c1540c88d76751e3b9d7d85abb176944fb556ceb336c71c8c38f3f3d240fdf46d0102fe7d82ca3cdd0a78db36
- SSDEEP 1536:u+BDlz7WQBcArn6vyZuZOpkVHMf1k8RUbozkIE3Vlyb2QS9+fIYa+:fBDlz0AOuoOpkWf13RYozkIE3VAAm
- TLSH T1E9838F92E36462F6F6AB81B4D2910753F731BB96031063AFB344C2853F12B91AF59365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\_hashlib.pyd
- Size 67KB
- SHA256 5dee7b9fff3e6d0abe20601b9e62f3a14cd048167ee0b80781131dc81dec9469
- MD5 f80fc3dbb5178396861d793c07229db1
- SHA1 2df50a792bfd038a370cc2b40ef6445107420080
- SHA512 fefa44172a52b6c85d88a980bf6e0f3a939209093cd0e09298be978dfd67c66fad51e969ef02dcaf21ac8ad45c81b1922b2e49a3d804f3411b31cfa804360177
- SSDEEP 1536:cXwAzOYBQcg7JKRQ+C5sIEDIRyb2QS9FfIk/w:aJ/sJKRQ+IsIEDI0N5
- TLSH T106635B86A69840A6DA2382B5C8E34F43F974F2522701979F6679C1CE2F233C3573B756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\_lzma.pyd
- Size 157KB
- SHA256 9099ef451fe61d8feef9e02894902b88fdc8ee404e3f8b7412b150878c973803
- MD5 d74403a7a01d1081e1ada23bc68ea73d
- SHA1 8928cc6ddad888e8f793606bcf87880195b3740a
- SHA512 d238626870c290d690357e50c1d3d3fa99830caf9d95b9dbbd33c74b54c90108b7611733ae4939b9ea9ac95a87a563e04f201312491b84f894a1efbb81e28618
- SSDEEP 3072:AJ66g4T5QW7JfyjEqkSkA51b4DznfJ9mNogUIsbkIEI1FRaT7z:AUR4Tp4QPZ8N4/xYOVb3Uv
- TLSH T170F35C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\_sqlite3.pyd
- Size 130KB
- SHA256 e69caeadb409777bce26f78622653558bbb86f08479b412399eaa0e6fd1e44f1
- MD5 2c0a9211324d749c78bbc681c0f5a06a
- SHA1 7db9bb6967adecd15bb6a00d9218f187cb6e84c4
- SHA512 244b44bf52550662e0c4a9302a3e8895c3ce93626eb44a8753cf512df28f9950c7dc007ae1ac65001a450998beff3573559cc14310ad4d1a048c0eef033cb56b
- SSDEEP 3072:E2Ev/eYuFrlt8pBbF56Cqe3tysIEDQJPTa:E2EStlCLF5t3ty9a
- TLSH T1D2D36B6B631801AAF9E782B8C5634643EB75F462572053DF41A0C28A1F373D36F3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\_tkinter.pyd
- Size 69KB
- SHA256 36675f9038cc1f1fea08b68ef38c5da94b41efbcd3a421421198f49f01afd8d0
- MD5 0aad7f83068dfe094174eda2a6e81c42
- SHA1 750a7fb9d7c43cc60ed5838c2424f37bbd324e5d
- SHA512 ed290592582597b9f3d615ebb2de322f91128fbfa1d4dbb08da46ba6034d01ba6806fbdf835c3a063c744b4136a37d4839e96d0a7ff5e7c951014eeca7382f33
- SSDEEP 1536:/3rQ5vzPC333f/x6pt33mZgZ0+jsIEDSlyb2QS9HfIkwx:/3slD233szGZgLsIEDSArb
- TLSH T135636D9B5768008AEEA3C139C5725F13E5B5B9625A20934F40A5C39E0F333F3A7BA751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\_zstd.pyd
- Size 491KB
- SHA256 526d977236cc63895902977f216bf3ca93a4233489240656b295eafb6f518d07
- MD5 3dbf9908e2bddd4346be7370bf6a8d87
- SHA1 ba5c0b6770b37943fafbf013bf575aaf461b73de
- SHA512 b87a623ad93fbf77500679f89daad61e9ee316d0fbc1e778d6a37e29f449c30ce108b24fca545a6ea6de8b9568c9fdee7b7f5ae54d51c7e6eb1ad0119f7348bf
- SSDEEP 6144:soRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFEK5+SClP:3RFcemgqKP2eeVC2Lz9kQeK5BCl9VdxX
- TLSH T111B48D43F29943EDE53BC4B8CF465A13FBB1780B1214964B97A5CB993F07B309A69309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\base_library.zip
- Size 1.3MB
- SHA256 b36322349f734efbc6171efe672e1f035cd45522f8e8033c86596d14781c7cb0
- MD5 9c8133d10e32b715c926027383ed5d21
- SHA1 8278b40ae6f10abcda2daf56654f712b090b93e1
- SHA512 3b82da9d168e2fdda5c412caa598231b415634c6a290f0330f5aee7cdd5aca6fbe9f37879d9373f12cef7a39d278b3c83939398363d2748318f1e7c3390c962e
- SSDEEP 24576:AdelbcGDZQRZlEYUQeOdP2m2df4vL/uUF3gR:AdumRwYU/0uUFs
- TLSH T162552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\libcrypto-3.dll
- Size 5.7MB
- SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
- MD5 b306c000f2b892736f0e66d265c61876
- SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
- SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
- SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
- TLSH T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\libtommath.dll
- Size 93KB
- SHA256 aaea8a20db7a7a96d4bef74ad724c4a02595a9c47659f6cbd6f145af0c97aa78
- MD5 ec807baa3ece2c54384055a292ecac6f
- SHA1 a7397391ec9569b1c53f499bd5f1bd7ff7cd0b40
- SHA512 198b1f8c27d3ad28c6b85924c85007f23d390eeed5ef8c4ff3e530f11da5a2f3b39d30e1779acb1f4b100fe97e70529c88f9a34751296b1cb14fac52251eb6b5
- SSDEEP 1536:c3RaimSoWEBrh2as3iwaOasKuWoSvMD9NNSyb2QS9svfIkxY:SqWEBkL3iwvrD9NNtER
- TLSH T11F936B47F6CA20FFC05AD5B2C3469313B6B2B9639B226ADF22016E251D15BD06F3F254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\python314.dll
- Size 6.5MB
- SHA256 854fe7549eb4b2ac478935a38ae2ca1b774c6fdc3d87f0263fbd697ff86d7149
- MD5 2e80dbbe49a92e731184c0b0893b220e
- SHA1 7aac631c5001ad6b1e6886a82e3c9e14215bd4f4
- SHA512 291c1d8fdc1973a5a439e59d03384a2b31d010cba357d37cf24c4706457b4277d66eac7f162d0208a5a1d255c6f8105c16972be439cb4a7877c90ea057b25f7b
- SSDEEP 98304:UUNfZZoy5opBcWVnrEYVISXP8YamvvxHDMiEAPIr7:UUNfZZo1IunrEEUziBIH
- TLSH T1CF668D66737801A5D9BB8035C9034647DBB1BC10AB30D34B49A4B6DA3F733635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\sqlite3.dll
- Size 1.5MB
- SHA256 5c47df970d2e8cc41239754ff167056fcecb1089f876736e51dab5d89f980300
- MD5 9cdaabbc390bee37b8b6ef3524ff1547
- SHA1 f90f75f20bdf715a38ff379e4d0da460319c7701
- SHA512 0cb6508b3bfe50cb6aeb679a4445b6a7ed0f8d89e2335f47dfd853106c04bb95b9acb6e886108f1ad67deeda3b9664096168cee7840a0db0af36cfe3aca53546
- SSDEEP 24576:ZDKX0pwDaOrROsxNkJPcG/ZBZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1flX3M:t8pOsxNkJPcGxDQuWRP+bZ6Icf4vC1fO
- TLSH T1AB759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7CF1594CAA92F53FE217BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\tcl90.dll
- Size 3.2MB
- SHA256 4ea18c5f4f977b827c5d6e3894328105a4c2838d3f3f927b33f96578daa15271
- MD5 f70c74b824e36660735ad03f68107bf5
- SHA1 09272b7c9b4d4292f54929135811a4d2a9397eff
- SHA512 89a13e468a79a9ea8135064991b68a2e8bd103bdfcf9bdd94341aab778d64e4f8b0e0fbed198729d5284d6dc9e310374ab392f85fa899a9ab21971deaa2f2d2e
- SSDEEP 49152:DLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugM:vWrPOVNFFvsJnNKfXAqRGYYx
- TLSH T152F5AE46EBA40068D5B7C27CC61ADD4BDFB274581364AADB14E05B612F73FD2237A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\tcl9tk90.dll
- Size 2.1MB
- SHA256 6a480fc83fba6e6a5ccc5979ba00313a1ac1d2a987cc764c4f5982895b18b00c
- MD5 3adcc60bd68a7bf21904020a2c54346c
- SHA1 ed827d226704232cd4be0e97d929c1dd812cba2a
- SHA512 f253c148a026af19e66d39bd30662e7503dc2f6a0bd817257196790640dacea7adf552a19fe6acc37afd38129924ef5cf1050e91249903dfabe44da9fc4c510b
- SSDEEP 49152:n/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6o:1s7+8JToVH+MC
- TLSH T147A55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\ucrtbase.dll
- Size 964KB
- SHA256 9f2ed1c609d6d5c4c5c1eab4da56da240bceb348ae98cdacf985dabf84376e1b
- MD5 ff17da6366de0235f32bc927e41aa032
- SHA1 f0f2e0dfa4e035b3dcdd5e423717ba6fcc3ae00d
- SHA512 7adf3ec190947197e323bf6c14ee0dcf42a26d67130fca08715dde61da697740da6ef2a2fcafe9335fcd53c3d18f40b118649f010d947329e166edaa23276ffd
- SSDEEP 24576:jVlncbBScMaURxDDMz2UyJaoOn8ynGo5ImxvSZX0ypniCm:ZlcURaUsz2U7LGjin
- TLSH T15225AE79B72C06FAC17BE1BCC957160AE5B63402477086CB03A64BB97E2BBD91637311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000015142\zlib1.dll
- Size 114KB
- SHA256 241c35ccfd3b9fba5ea5ce9c9a3d6f532df10cc7236c985a1570a01c3cb714bb
- MD5 5026f863bcaff956cfa581deacc36ce1
- SHA1 08804e475ca93f42cc3482d3fb7f09d7a67ac4b1
- SHA512 cd58e0047a50a7c3f387e0423fcf3166948fef485014ebabf7e76810b2ae3cb099a724f4a55203ae91120ac11ca25cd7e6f3ae05c4fba734e39451634cc2f35c
- SSDEEP 1536:ueKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fBuW:FNGH+X34najvon8PVh2FXws+ZhDB
- TLSH T18DB39E87799620AED1B7C230D2E65B22F67578810B1D0BF74285D3A42F02BD06F797E9
- MD5 SHA1 SHA512 SSDEEP TLSH