Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 12:16
Behavioral task
behavioral1
Sample
By.Zeeshan_Shop.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
By.Zeeshan_Shop.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target By.Zeeshan_Shop.exe
- Size 5.3MB
- Sample261024-pflylahx71
- SHA256 2b357d31163c418b94957efafba089ae192b6924e5b4d10eac280c58139b658e
- MD5 c3c12aa5e12c9510cbfe2f626420fad1
- SHA1 b28ca3cfa595c5947dedd06b76b1a4a9212323c3
- SHA512 26fe0354eb3ba495664d9c825dbaab4513386c4bf54e16344a47bd379e7f75ad093e2e1934ec3fab59ee6f3f64ec178c0dc6fae871c2e28f013d24ad25672546
- SSDEEP 98304:/nK3ezbzb71QGQCPDbZfHayCb7BJ5mjwNwwMeZYobSr+6AE4y7N:/nKwvdQmRfaycBIGpEo2z4u
- TLSH T10D4633A866A818F4F9BBC13E4D62405DD5B1BC1643A5E2C703A58AE70FA76F03D7B740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 1796 By.Zeeshan_Shop.exe 1796 By.Zeeshan_Shop.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 400 wrote to memory of 1796 400 By.Zeeshan_Shop.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\By.Zeeshan_Shop.exe"C:\Users\Admin\AppData\Local\Temp\By.Zeeshan_Shop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\By.Zeeshan_Shop.exe"C:\Users\Admin\AppData\Local\Temp\By.Zeeshan_Shop.exe"2⤵
- Loads dropped DLL
PID:1796
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\VCRUNTIME140.dll
- Size 106KB
- SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
- MD5 870fea4e961e2fbd00110d3783e529be
- SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
- SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
- SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
- TLSH T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\_bz2.pyd
- Size 81KB
- SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
- MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
- SHA1 44577016e9c7b463a79b966b67c3ecc868957470
- SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
- SSDEEP 1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
- TLSH T10B839D93F76095B5F41BA2759AA14393E331FE49039093EFB244831B2F13B913C6536A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\_decimal.pyd
- Size 242KB
- SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
- MD5 6339fa92584252c3b24e4cce9d73ef50
- SHA1 dccda9b641125b16e56c5b1530f3d04e302325cd
- SHA512 428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84
- SSDEEP 6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
- TLSH T150345C16A3490CA4DE778074989B9B57FBB278854360D3CF43A4CAA63F576A323BD344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\_hashlib.pyd
- Size 60KB
- SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
- MD5 d856a545a960bf2dca1e2d9be32e5369
- SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
- SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
- SSDEEP 1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
- TLSH T136536D05A69440B9D8674278CAD71F5BEAB1F0405351ABEF0358C1CE2F237C3EAB6796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\_lzma.pyd
- Size 153KB
- SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
- MD5 0a94c9f3d7728cf96326db3ab3646d40
- SHA1 8081df1dca4a8520604e134672c4be79eb202d14
- SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
- SSDEEP 3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
- TLSH T1F8F33992B394F4E6F6228C78D6664F13D7F678490320829A12CCC37D2B1FB755A2A717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\_socket.pyd
- Size 75KB
- SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
- MD5 0f5e64e33f4d328ef11357635707d154
- SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
- SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
- SSDEEP 1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
- TLSH T1B0735B12A69050B9D2738175C6635F23FB70F480139593CF1264DAAE2F23792EF7AB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\base_library.zip
- Size 859KB
- SHA256 03f6a37fc2e166e99ce0ad8916dfb8a70945e089f9fc09b88e60a1649441ab6e
- MD5 22fee1506d933abb3335ffb4a1e1d230
- SHA1 18331cba91f33fb6b11c6fdefa031706ae6d43a0
- SHA512 3f764337a3fd4f8271cba9602aef0663d6b7c37a021389395a00d39bd305d2b927a150c2627b1c629fdbd41c044af0f7bc9897f84c348c2bccc085df911eee02
- SSDEEP 12288:lgYJu4KXWyBC6S4IEa8A4a2Y42dOVwx/fpEWertSLMNM:lgYJiVBFLa21nVwx/fpEWe+MNM
- TLSH T1A4153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\libcrypto-1_1.dll
- Size 3.3MB
- SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
- MD5 6f4b8eb45a965372156086201207c81f
- SHA1 8278f9539463f0a45009287f0516098cb7a15406
- SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
- SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
- TLSH T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\python310.dll
- Size 4.3MB
- SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
- MD5 deaf0c0cc3369363b800d2e8e756a402
- SHA1 3085778735dd8badad4e39df688139f4eed5f954
- SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
- SSDEEP 49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
- TLSH T1DC267B22A26401A4D9B79477C5238647CBF1FC552F20E34B41A4BAD92F73BA316EF706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\select.pyd
- Size 28KB
- SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
- MD5 c119811a40667dca93dfe6faa418f47a
- SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
- SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
- SSDEEP 768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
- TLSH T111D2AF8B9B9058C9E863C57258E64F02FA34B661875082DF3319C26D2F237C277B6769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI4002\unicodedata.pyd
- Size 1.1MB
- SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
- MD5 4c8af8a30813e9380f5f54309325d6b8
- SHA1 169a80d8923fb28f89bc26ebf89ffe37f8545c88
- SHA512 ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
- SSDEEP 12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
- TLSH T18A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
- MD5 SHA1 SHA512 SSDEEP TLSH