Overview

overview

7

Static

static

3

basic.exe

windows10-2004-x64

7

basic.exe

windows11-ltsc_2024-x64

7

Resubmissions

24/10/2026, 17:09

261024-vpfe3az13r7

24/10/2026, 16:36

261024-t4eawacx6m7

24/10/2026, 16:34

261024-t3lzbszz6q7

Analysis

  • user interaction
    yes
  • max time kernel
    49s
  • max time network
    54s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 17:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    basic.exe
  • Size 16.0MB
  • Sample261024-vpfe3az13r
  • SHA256 790fdc26ca8dbde345073a7f05e2f1d0f4549c0c41bb8a642d198b9562825f52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\basic.exe
    "C:\Users\Admin\AppData\Local\Temp\basic.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\basic.exe
      "C:\Users\Admin\AppData\Local\Temp\basic.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:3088
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe67d1c728,0x7ffe67d1c734,0x7ffe67d1c740
      2⤵
        PID:5044
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,3459537350384725035,14239017639802248695,524288 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
        2⤵
        • System Time Discovery
        PID:2968
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,12345561697885864772,9600280486254790645,262144 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
        2⤵
          PID:1264
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,1014606386121155429,6490382530905806377,524288 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
          2⤵
            PID:4488
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,7857146385380913200,4488732858701642735,2097152 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
            2⤵
              PID:5916
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,3731370658870697471,3777483027431488930,2097152 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
              2⤵
                PID:4616
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,3681030879791726536,13363056998107434462,2097152 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
                2⤵
                  PID:1332
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,3722893801988042810,16309037117007909936,524288 --field-trial-handle=1988,i,12933302453920061132,6300516640649410179,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
                  2⤵
                    PID:3188
                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                  1⤵
                    PID:1324

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        4852643e-b195-4369-b555-d416f171490b.tmp
                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4852643e-b195-4369-b555-d416f171490b.tmp
                        • Size 4KB
                        • SHA256 f2556e2807ac6f9fdd048157ecfa5d3026e3cee87072ea155578a0efa7a5dd54
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        384c3d6c-bbad-4e92-9862-2a76f9ba245b.tmp
                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\384c3d6c-bbad-4e92-9862-2a76f9ba245b.tmp
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512
                        Submit Download

                        VCRUNTIME140.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\VCRUNTIME140.dll
                        • Size 174KB
                        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VCRUNTIME140_1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\VCRUNTIME140_1.dll
                        • Size 48KB
                        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _brotli.cp314-win_amd64.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_brotli.cp314-win_amd64.pyd
                        • Size 836KB
                        • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _bz2.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_bz2.pyd
                        • Size 86KB
                        • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ctypes.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_ctypes.pyd
                        • Size 139KB
                        • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _hashlib.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_hashlib.pyd
                        • Size 67KB
                        • SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _lzma.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_lzma.pyd
                        • Size 157KB
                        • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _queue.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_queue.pyd
                        • Size 35KB
                        • SHA256 2fd8668f52b34d0e71ae48784bd2e7d35e5d99df6f641edb0fc279235a187c8e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _socket.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_socket.pyd
                        • Size 85KB
                        • SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ssl.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_ssl.pyd
                        • Size 186KB
                        • SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _wmi.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_wmi.pyd
                        • Size 39KB
                        • SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _zstd.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\_zstd.pyd
                        • Size 491KB
                        • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        base_library.zip
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\base_library.zip
                        • Size 1.3MB
                        • SHA256 411bbd8735c3724f215daf033c59eb07fec4947e6f4a64d4d524cc5798af0b2c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cacert.pem
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\certifi\cacert.pem
                        • Size 230KB
                        • SHA256 2ef52ad56b4803e264045c915e55c236cbfa045b84b81efefc218a19eb44bd2b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cd.cp314-win_amd64.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\charset_normalizer\cd.cp314-win_amd64.pyd
                        • Size 116KB
                        • SHA256 2fc82a309cdd4499e5dba1a87671f9ac3a3a35e44008afafd7867888d400f3a3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        md.cp314-win_amd64.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\charset_normalizer\md.cp314-win_amd64.pyd
                        • Size 206KB
                        • SHA256 ca72897ac6a6aca48bac72b409bb3cbe6326b755b37d733cad731d5624e17f79
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libcrypto-3.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\libcrypto-3.dll
                        • Size 6.0MB
                        • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libffi-8.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\libffi-8.dll
                        • Size 38KB
                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libssl-3.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\libssl-3.dll
                        • Size 1.3MB
                        • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        python3.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\python3.dll
                        • Size 72KB
                        • SHA256 6c45910e7c82617ca6360820de861699cc99f9efee434df290aa4c6e38f39886
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        python314.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\python314.dll
                        • Size 6.5MB
                        • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        select.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\select.pyd
                        • Size 32KB
                        • SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Lorem ipsum.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                        • Size 1KB
                        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        unicodedata.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012cc2\unicodedata.pyd
                        • Size 741KB
                        • SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download