Overview

overview

7

Static

static

3

builder.exe

windows10-2004-x64

7

builder.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/10/2026, 21:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    builder.exe
  • Size 13.3MB
  • Sample261022-1jdl6sas5m
  • SHA256 0a7e8409ff2d2440e43cf49913a5d8e21a81cbde5bc18f731aef24e810e5b79a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\builder.exe
    "C:\Users\Admin\AppData\Local\Temp\builder.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\builder.exe
      "C:\Users\Admin\AppData\Local\Temp\builder.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:2616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:2344

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_bz2.pyd
        • Size 71KB
        • SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_cffi_backend.cp311-win_amd64.pyd
        • Size 175KB
        • SHA256 0b5c05bf3e9da14c33566d2c546fb7618ac7fc2b89365a66cfb1082ffe3d898d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_decimal.pyd
        • Size 237KB
        • SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_hashlib.pyd
        • Size 52KB
        • SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_lzma.pyd
        • Size 149KB
        • SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_socket.pyd
        • Size 66KB
        • SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\_tkinter.pyd
        • Size 52KB
        • SHA256 2cc987f71fe6a28e8ca5fc1f14c26bd6efa59b36e91d52901c17a5e57c4f0b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\base_library.zip
        • Size 1.4MB
        • SHA256 af948abcbb1e245535f7ff6fff46258b11ecf38b91fa5c2f31eeb50280114ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.5MB
        • SHA256 6a42262974f0e086c1f2defaff4ccd9fb25046cf193422135e2dda5b4b29b2a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\python3.dll
        • Size 54KB
        • SHA256 8fda4948f6fc2bed1c7d1ece9596a3450c772775e48046c0bf701517d78ae9e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\python311.dll
        • Size 5.6MB
        • SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\select.pyd
        • Size 18KB
        • SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\tcl86t.dll
        • Size 1.8MB
        • SHA256 59488f67a8e75a5d51c7cb865436b5581fbb16014e9233b34db0c22bea6d4765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\tk86t.dll
        • Size 1.5MB
        • SHA256 e9a5815ad39619e22d581b7124bbaa4192e701229956a2edbaffc0c420864561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003c42\unicodedata.pyd
        • Size 1.1MB
        • SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download