Overview

overview

7

Static

static

3

net8.0-windows.rar

windows10-2004-x64

7

net8.0-windows.rar

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    64s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 00:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    net8.0-windows.rar
  • Size 73KB
  • Sample261023-a1chbsbs8r
  • SHA256 1c8ace9a9ff61bc337f26e561a9a34b76d82b6db05a08b0b835df41b419e9022
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\net8.0-windows.rar"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3796
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1604
    • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
      "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of SetWindowsHookEx
      PID:3696
    • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
      "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of SetWindowsHookEx
      PID:1340
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:1588
      • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
        "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:2816
      • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
        "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:1456
      • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
        "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:2724
      • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
        "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:1136
      • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
        "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:6064
      • C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
        "C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:2580

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            kittens_meowing.wav
            • Path C:\Users\Admin\AppData\Local\Temp\kittens_meowing.wav
            • Size 254KB
            • SHA256 6695c330c7c4a2fdec8347549ed659500b378a24185363e542c66a944a64e645
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Mei Mei Virus.deps.json
            • Path C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.deps.json
            • Size 431B
            • SHA256 b1862f4b1e5da014af563ca8734c7aff928b4f13e7b977268507c2aaeed15ec3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Mei Mei Virus.dll
            • Path C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.dll
            • Size 14KB
            • SHA256 75523a358c28f8745bdca2c05c6535368be5b3efb25271535c6e7ddf22dfebbd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Mei Mei Virus.exe
            • Path C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.exe
            • Size 148KB
            • SHA256 54e1d39b694b5ffb086042f0fc0d8e1bc415fba3aa80600be41e82214ebb5dad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Mei Mei Virus.runtimeconfig.json
            • Path C:\Users\Admin\Desktop\net8.0-windows\Mei Mei Virus.runtimeconfig.json
            • Size 443B
            • SHA256 7e79af92820e50910b90f1cade2728f45987393f24b50e384dc225d9773b7194
            • MD5 SHA1 SHA512 TLSH
            Submit Download