Overview

overview

7

Static

static

3

0d3a0c607c...b9.exe

windows10-2004-x64

7

0d3a0c607c...b9.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0d3a0c607cc22ea235f0570fdbb03b840a5c8e6fe0f1811e7df87bea888684b9.exe
  • Size 13.6MB
  • Sample261011-negf2sts7k
  • SHA256 0d3a0c607cc22ea235f0570fdbb03b840a5c8e6fe0f1811e7df87bea888684b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 39 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d3a0c607cc22ea235f0570fdbb03b840a5c8e6fe0f1811e7df87bea888684b9.exe
    "C:\Users\Admin\AppData\Local\Temp\0d3a0c607cc22ea235f0570fdbb03b840a5c8e6fe0f1811e7df87bea888684b9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Users\Admin\AppData\Local\Temp\0d3a0c607cc22ea235f0570fdbb03b840a5c8e6fe0f1811e7df87bea888684b9.exe
      "C:\Users\Admin\AppData\Local\Temp\0d3a0c607cc22ea235f0570fdbb03b840a5c8e6fe0f1811e7df87bea888684b9.exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      PID:2544

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\VCRUNTIME140.dll
        • Size 113KB
        • SHA256 b72f287881f6c9fbd5951bcaaf843272fad19fa5acf577f90bb54c750a29c873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\_bz2.pyd
        • Size 82KB
        • SHA256 b55e00ba39a9eac6388f873d542ec3fa916e29cc0ed02072785406563539ea25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\_ctypes.pyd
        • Size 131KB
        • SHA256 ddb67f85e936153971ce3e493c6239856492f506b58c7ab3da722587fdc78bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\_lzma.pyd
        • Size 160KB
        • SHA256 1d83910f80568775aef239807d28f4490b503d7498c017cf7ad82fedaff445d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\_queue.pyd
        • Size 33KB
        • SHA256 d587ec0b0ae0fc41eb70330f710d368f843d96e0ac1d9ca6ea7594b02e53f0f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\base_library.zip
        • Size 1.3MB
        • SHA256 281fd25327f2df3d252a54feeb1e62ac8069583bd048ef93a65ef396ce4bcbb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\libffi-8.dll
        • Size 39KB
        • SHA256 28560f0a430742d7e19eb0daf2509950c69a7477a43d76d2ed378f6c11efa235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_image.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\SDL2_image.dll
        • Size 122KB
        • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\base.cp313-win_amd64.pyd
        • Size 30KB
        • SHA256 66d997da2dd61b2f20cb042bcdf4e50ce9e76af8cfa23ba0130aafe25ac407ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bufferproxy.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\bufferproxy.cp313-win_amd64.pyd
        • Size 18KB
        • SHA256 1dfb23e182b9e115a17e162ac97f29e4b71a04b4291f863db9488bca04aec533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        color.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\color.cp313-win_amd64.pyd
        • Size 35KB
        • SHA256 293fafd79cc23feac8cfc270df306ad7285d192331b9b9436b6631024cea35d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\constants.cp313-win_amd64.pyd
        • Size 49KB
        • SHA256 c346ee23b6695ed6280f71d13cd4c5ecef569e12f331508008e60371e4350207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        display.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\display.cp313-win_amd64.pyd
        • Size 44KB
        • SHA256 2b87801d06d55ee5eaf8c87d647a8e95f14e6fcf3b8e1d9a633a50c88b398920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        draw.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\draw.cp313-win_amd64.pyd
        • Size 49KB
        • SHA256 c8db798417679164d7a447147be1c7370c9cce5323cf9db741fc3ef5e4d42f3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        event.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\event.cp313-win_amd64.pyd
        • Size 43KB
        • SHA256 494f7d0958ff406d826cc1b5fbd3df954cdf8dabebf30e3be74924c9355b324a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        image.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\image.cp313-win_amd64.pyd
        • Size 29KB
        • SHA256 7382c07d5e416d91cfeff335da831614b7e0fd3fd03f9ecff0e852fc4f164ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        imageext.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\imageext.cp313-win_amd64.pyd
        • Size 17KB
        • SHA256 8c83d5ef6cfb06870eb5f1b54a709377b0040c1dd2430a7cbe47595d8b95f163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        joystick.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\joystick.cp313-win_amd64.pyd
        • Size 20KB
        • SHA256 f5a9beeffa97dfa4ead68bfd26799657b911ed3a3442c1ba44f7acc98285d3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        key.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\key.cp313-win_amd64.pyd
        • Size 20KB
        • SHA256 e4a92821232e6db7df15454911ab791ff23debe31ebcbd73e16b7a76b284613e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng16-16.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\libpng16-16.dll
        • Size 206KB
        • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\mask.cp313-win_amd64.pyd
        • Size 54KB
        • SHA256 8cb6bee31fe4072a8c551ed96d1281dab507d2cdbbcce32644d8ed8077cb1df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        math.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\math.cp313-win_amd64.pyd
        • Size 75KB
        • SHA256 1b217a687d7adf4732abd227b747465f0fc83a6bfb3064e9a4729075ac603159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mouse.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\mouse.cp313-win_amd64.pyd
        • Size 19KB
        • SHA256 e36df76dbd1577b46711c5f34e20b03ebd4a160c44d75faf814cd3a5e69ffd4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pixelarray.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\pixelarray.cp313-win_amd64.pyd
        • Size 47KB
        • SHA256 6eaa6e113527bec6e49f6bacb165e1358202a8ece3f8206a26d915a945f4f53b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pixelcopy.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\pixelcopy.cp313-win_amd64.pyd
        • Size 26KB
        • SHA256 492d8bbb31bd3ea0bd280d45844e67b47ed8962b4acbd6e74a23497a5d6f9399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rect.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\rect.cp313-win_amd64.pyd
        • Size 44KB
        • SHA256 19c268113752ec69f0de20d93190fca397bdbdffcca20890ed4f8627e3e3f722
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rwobject.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\rwobject.cp313-win_amd64.pyd
        • Size 19KB
        • SHA256 8393c52dcb1d0bef5a2712136dd7ff1a7ff3ce91ea72199b74d74e28c82e7093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surface.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\surface.cp313-win_amd64.pyd
        • Size 233KB
        • SHA256 358e005063a967b5c876caea1d4e72451fa1018693c140a45afbb1cafc860b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surflock.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\surflock.cp313-win_amd64.pyd
        • Size 13KB
        • SHA256 2460b9d33675b20596f4a06b0d387fd09a0b0dc37a21a07cee72273e02585b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        time.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\time.cp313-win_amd64.pyd
        • Size 18KB
        • SHA256 dde2128c9aa2a0f08dc211692577cb6857d8f674d27b98b1b28bef1175bfbefa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\pygame\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ce02\python313.dll
        • Size 5.9MB
        • SHA256 0f3d545b9bfa5bfeaa4daa34f0fb6c25d3a33b44f131e022b6322d9169cc0993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2544-138-0x0000000062E80000-0x0000000062EA4000-memory.dmp
        Download

        memory/2544-136-0x0000000068B40000-0x0000000068B7C000-memory.dmp
        Download

        memory/2544-139-0x00007FFCECC60000-0x00007FFCECDE2000-memory.dmp
        Download

        memory/2544-137-0x000000006A880000-0x000000006A8A7000-memory.dmp
        Download

        memory/2544-135-0x00007FFCF0AC0000-0x00007FFCF0D2C000-memory.dmp
        Download

        memory/2544-140-0x00007FFCF0AC0000-0x00007FFCF0D2C000-memory.dmp
        Download

        memory/2544-170-0x00007FFCF0AC0000-0x00007FFCF0D2C000-memory.dmp
        Download