Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 04:48
Behavioral task
behavioral1
Sample
815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe
- Size 8.8MB
- Sample261014-fe3qaafx9s
- SHA256 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa
- MD5 84fd7aaded0f7913aebda669e0380d8b
- SHA1 c8604be16ee4b887f29428ba350067ec18de36c6
- SHA512 adbeb252423cd66fa3afb26a7fbdde1e0fd0f03abe365f1b9a1c82cff13104d5735cbcffbc9afa860b92c25026826245f651e35861cdd964dbc69e54482fd551
- SSDEEP 196608:eWLU7+cdPx4oOuULh27kq17y9Ffmq7lajSQqHV0rzKEQ7QdDhpAX:hoxdJdZyv7E6+r+EcQ5AX
- TLSH T158963364E3A000F9E4E3873DC5828626D67B7C111B90C9CF22E49E563E67BE49D3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
pid Process 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 5676 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1840 wrote to memory of 5676 1840 815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe"C:\Users\Admin\AppData\Local\Temp\815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe"C:\Users\Admin\AppData\Local\Temp\815daa515fa4f7e0a7d4ea9f13b3eaf8feb1ef867ade74cc3892ed2be59d2caa.exe"2⤵
- Loads dropped DLL
PID:5676
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\VCRUNTIME140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\_bz2.pyd
- Size 71KB
- SHA256 ea5aa5c49abe44d4441fc7bd5ca906212d271d7242fc89248c665abe2540a6cd
- MD5 e2bbf84123cf9bdcb880c0b77b1cb90d
- SHA1 1d2f99224335318591aee16ededada67c709feca
- SHA512 5a2479e13418b67af14e7fde54f8dbdbf1d6c075193bf0ce429eb6b7f06b2bb20d5abe347cd3acc080e24b3e053bb9228a50858c80376a0a62f343cef806a6ea
- SSDEEP 1536:vTlwz7aM8g9Cpsgy1lOR/zkO0Fxl8XEsHb0ICIFLV:Llwz+1TOp7OdKxKXXHIvIFLV
- TLSH T106636C52B3B472F6F5AF81B99A820353E730BE550710A3AFB344835A3F12F51AD68365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\_ctypes.pyd
- Size 120KB
- SHA256 7c02c8573f10caca9e1cc823d257974fbdef03a7360d22af2dce7b3179111e81
- MD5 31519cb7373b1a6ac6726651d370bc09
- SHA1 4efeb5ac71ec1af6e4ddcd41be4b7de7b07d44e1
- SHA512 3e609446a7da0da8c4f7f55be9bacd4b54464fa23a377dca80cb096bead5f640ef58ec9f181031f888f82b04cb345274d7423203cb7af1afae1528e93bde2a71
- SSDEEP 3072:xWWOAk2gZSqO6zNLp8e7f/FM8gfl4PKBj2nLIFyP:xYmqOm9f/FXgNIK4n
- TLSH T198C36C0B73A801AADB678178C5336E47DBF1B45A131147CF02A4C69A3F23796AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\_lzma.pyd
- Size 149KB
- SHA256 97a891e9237379b2cea58a5e243b557dd76a426612ba2871b2d5c28d62a8e672
- MD5 e6d66978b4c11368550be8510486ba59
- SHA1 774848e7623d536295dc66d43b43c9189a38a596
- SHA512 ab80a1e5c828606d7706bdbec8eb8f488d1e590a62d3892251b6c1622bd7e41e3cb067c8235159a7b2dac0d3d33e0c1b1f006c918e85a73b25bb1aede79787a4
- SSDEEP 3072:Hbyh4SOP0rtnoscUAePRnOdznfl9mNoM7wFKRKevIF01:7DSOsB8PeZ2dYOM71Ke
- TLSH T14FE32891B254F4D6F2228C34C9674F67E7F978095310A29E01DC837D2B2FB766A6A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\_socket.pyd
- Size 71KB
- SHA256 074bddeb66df8a42ef206534a240f6729369dfdc839d03c73839f33d150c2dcd
- MD5 30f96268f41b34202dcaf3a0e4c2ec3d
- SHA1 d738bcdee692e091aed721022efba89213b68d61
- SHA512 660787402ec4ddf80f00a967ce4da8d4c020b0a044cb79a5af10b188f2133c57128fda5027eb4e3ddc585f0d26de49feb25e446ed4b57706c913c29bf2c25704
- SSDEEP 1536:oms9Ytjgu1g8R8O1j2ypTwQlyJ+i+nzxy7FqFLvxtq3oK50ImIFyw:oh9Ytjg6gYQypTwQlyJL+nzx4kvxSALs
- TLSH T125633B11A6A041F9EB72C0B6C1735E62FBB4B4C013A5A75F0466C95D1F33782BE7AA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\base_library.zip
- Size 1.3MB
- SHA256 56d2922458ccae94fb45f668d3b9924c3295c87718bc155cb459fd4c54729bda
- MD5 4c90b83e0228982a2a002ee9d4cb676c
- SHA1 809fa96239ecea525e7746d2d4eb4df225c5bf9c
- SHA512 27009af8aae94b34feb4792e2842dede4a70b86deb47a4763ee5e0c1c98997726b7438e37b2a039755c3762a80fade07fe1a5d35e26d79d7d75ac7031c9dd6a3
- SSDEEP 12288:PtYzGN8Txew3UKBW7WpG55HHwsEwi2cPPdxhYGQnL+DHAuIva80201jwCVRDVoi/:CSuTxewpo7WpYw05cPPdxhYZwAwdZP
- TLSH T1E8651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\libffi-8.dll
- Size 27KB
- SHA256 00c9d0b65d5f4dd796e892923388702c640271bdd7b9a63289bca00be61778ed
- MD5 501a2f375bfb6d367f9848b46eaf7ae6
- SHA1 975d630099f7b34080106e47ea0a1c81e10db4f7
- SHA512 76de4ae250f90ca942ceb88b12a2a1ef2c0749726fdac240a6146ecab3394dd9642ba1ba2c2e322b2d268497258dad0cb454597ea11b5377bfa6f1a8081eb7b3
- SSDEEP 384:XZI/wgEI7ztptZKrOdS9LNdPlm05iq97HeE6H1ruEVRCXv30vG:aQ5lN7m0QqkN40+
- TLSH T14DC23947A59415A4E2A7C03D86339D5AC33578351B60F6CF03E192BE2E5BAE9DB3C308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\python313.dll
- Size 5.9MB
- SHA256 597c6747e061ee5a53bf7fefabc20483f3912510510e77ce2398ab40f5e2a118
- MD5 1660c766aece4585dd22a641b9ff6cf6
- SHA1 4da2dd0c94f453a5ad36de73f9eee16d864cdf86
- SHA512 9ec6eb7a4c260a2a26275ca4b8638a461a3bdc7faa45561b4c6cd89e68b02b5a075766884febcee6d9f7c99d49f4078492cdfe2a40c92369aa8698eceb8d56f4
- SSDEEP 49152:gCaLhdzFgmsP8dwZYu678tZeMJSdIYiU9kstPKc8OOX88cLlyJDCY9sIuxM5UWgv:0LhFymSnY2xdrgboHS1svFveHDMiErG
- TLSH T11D567C06725E40ACD97B8079CA078A0BEBB27C553E60834B61E6BB5D2F73363476E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\select.pyd
- Size 18KB
- SHA256 509daae7556a1a48032d9c91bf79727f47499d4e519f6ee909740c2643c27ae3
- MD5 3906bcc75cb33b27d924234eda9b497b
- SHA1 c8d0059b4d885aa0becc839dac48fb00aefebb82
- SHA512 b8e622b2cd6162e1961ad195c61529e034d32a4be0584e64edfaca8bb16148a071bb99338557cdaaff4ab72aab5b91c09d99cf70e7727c8c7a7b9b29a34b3fc9
- SSDEEP 384:5pjg7ayqJPyJGfLl//V+ZnT0jivTAs5Qoa0sjmIF9Gg:nSW1+ZnLLTuR0ImIF9G
- TLSH T1E7824C46BB74A0D9D1B2C172C9231F02D936B536572243DF63B485AD3F67B826B36B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007302\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH