Overview

overview

7

Static

static

3

client.exe

windows10-2004-x64

client.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    43s
  • max time network
    50s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 02:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    client.exe
  • Size 64.6MB
  • Sample261024-defjms11gx
  • SHA256 03bd923bfd1386f381896d946d556d19dfc46b9f2c8b881d90a8bd20153f31ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies data under HKEY_USERS 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\client.exe
    "C:\Users\Admin\AppData\Local\Temp\client.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Local\Temp\client.exe
      "C:\Users\Admin\AppData\Local\Temp\client.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "shutdown /s /t 0 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:672
        • C:\Windows\system32\shutdown.exe
          shutdown /s /t 0 /f
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3280
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3a24855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:576
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k CameraMonitor
      1⤵
        PID:4260

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\VCRUNTIME140.dll
            • Size 174KB
            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_asyncio.pyd
            • Size 75KB
            • SHA256 e96e9c3ed48739ed34cc0a9e42b5a362018962fd21f4bea5f875e48b93af5a7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_bz2.pyd
            • Size 84KB
            • SHA256 c8d0e5b1b394597396e3eb04dc73cb26679bbfb9762e7b64332bbd63af385801
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_ctypes.pyd
            • Size 139KB
            • SHA256 bd3da14d4b851afa4057f664073e98f546b2a22fd05a0a257504df3adc3d9a6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_hashlib.pyd
            • Size 71KB
            • SHA256 65f921fdee1a34ef18a5635cd9cfea25f8e6650883be79a1a520d3721383eb3a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_lzma.pyd
            • Size 167KB
            • SHA256 717e15be558846375b5c7b93e9275c35147da744786514b3e7e56b7ef7d69b3f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_overlapped.pyd
            • Size 56KB
            • SHA256 8b91dac101597c2c6fab9f4c5ac92caf1d180bb9e32e6acad572135f43d7cb22
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_socket.pyd
            • Size 86KB
            • SHA256 2ee21e2b37d78458454e81bf529128cb0c98f92254635f5265222647aa850787
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_ssl.pyd
            • Size 192KB
            • SHA256 581bc1e1ce0522d2ddcdd6e4865fe47f1de9f7f52474e3950ddfc0c8dd966c5b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_wmi.pyd
            • Size 38KB
            • SHA256 73d029da93e92b6846e24c2c067ec1abe4351c86536abac746725344b05bbdb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\_zstd.pyd
            • Size 494KB
            • SHA256 49eda8c6a95c5b8e0373f880373fc52fab557c1b42e0336f374131cd999565b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\base_library.zip
            • Size 1.4MB
            • SHA256 34ab3000d74828c2555b10725f1f02e1a7543689179838d38802eb641babb90a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\__init__.py
            • Size 6KB
            • SHA256 674817e87409bc589608ef9f4dd4c1a49f600b5e85ca8b106b3b0a9eab5c46cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config-3.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\config-3.py
            • Size 748B
            • SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\config.py
            • Size 123B
            • SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\data\__init__.py
            • Size 73B
            • SHA256 f4ce16721ed7f623a4dcc443ba600d1856db610cb2c3d53c13a8ca028cc68f6d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            load_config_py3.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\load_config_py3.py
            • Size 253B
            • SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\mat_wrapper\__init__.py
            • Size 1KB
            • SHA256 c44707ea1c76f35518ae572b6c1989d76c2ada7e850432e41805dfe112d4e306
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\misc\__init__.py
            • Size 38B
            • SHA256 495bd79594cce174673e372c85c4dd8f4ffdf2b3a73fd4623955b0d55de0d462
            • MD5 SHA1 SHA512
            Submit Download

            version.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\misc\version.py
            • Size 95B
            • SHA256 c93a418793fcb15b9b4316c0741b8336740e490e94f3b7d1ebe8cd5f6f23815c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\typing\__init__.py
            • Size 4KB
            • SHA256 f8a066f22a98b56641a69200f0aaf9c3b5832b2f59f57862e56289cced8d9179
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\utils\__init__.py
            • Size 344B
            • SHA256 2b16990b35b569af1ca7239dc10f7b24ec62f27a46626b1e2f1271d2e1aa3554
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            version.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\cv2\version.py
            • Size 96B
            • SHA256 fc17efee9203c23cac641981068621e80d3b0bbabe459f4133c9b2b4d91957fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\libcrypto-3.dll
            • Size 5.7MB
            • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\libssl-3.dll
            • Size 1.2MB
            • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
            • Size 19.6MB
            • SHA256 ed4f167a5330424524f45258e7ca2c8d7f03c0cba1f30ee4985553ac1f88ecf8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
            • Size 561KB
            • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiarray_umath.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\numpy\_core\_multiarray_umath.cp315-win_amd64.pyd
            • Size 3.7MB
            • SHA256 b9476028d375e0c48ed6870284a61e87664c1181589ac5ff95dbc97469bb41c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _umath_linalg.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\numpy\linalg\_umath_linalg.cp315-win_amd64.pyd
            • Size 110KB
            • SHA256 1589ca32f2a0592a154fb2fbedf071c69d359daa3619842104333bdf2d34bf1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\python3.dll
            • Size 74KB
            • SHA256 bb493c03a4aea82c0d3805dda0301ea30dee1dadafdeec5006f1e5c20b145d99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python315.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\python315.dll
            • Size 7.5MB
            • SHA256 a302b823d1ca773c534c5692a8a7c6215b4ac93cfcda9fc7e1d3a10e3cdd0eef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\select.pyd
            • Size 32KB
            • SHA256 bcec7c662876364122be2d03b326d121a79dbc679210248a3e035de52a392631
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            speedups.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\websockets\speedups.cp315-win_amd64.pyd
            • Size 10KB
            • SHA256 4c065c91d0f8fa3b286e2001d8c32f1503e2e2c54b133f3d673e3275f8511aec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            INSTALLER
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000006d02\werkzeug-3.1.9.dist-info\INSTALLER
            • Size 4B
            • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
            • MD5 SHA1 SHA512
            Submit Download

            memory/3020-206-0x0000025C03D70000-0x0000025C03D71000-memory.dmp
            Download

            memory/3020-207-0x0000025C04D30000-0x0000025C052F4000-memory.dmp
            Download

            memory/3020-208-0x00007FF97DFD0000-0x00007FF97F37D000-memory.dmp
            Download