Overview

overview

7

Static

static

3

Zapret_Helper.2.0.exe

windows10-2004-x64

7

Zapret_Helper.2.0.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 22:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zapret_Helper.2.0.exe
  • Size 5.9MB
  • Sample261027-2r8yqaxtct
  • SHA256 6b336a0f5527d7f4c7ae53a154e04bb5b3b92bb470865602a657f831a6eecba1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zapret_Helper.2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Zapret_Helper.2.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Users\Admin\AppData\Local\Temp\Zapret_Helper.2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\Zapret_Helper.2.0.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4808

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\VCRUNTIME140.dll
        • Size 95KB
        • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\_bz2.pyd
        • Size 85KB
        • SHA256 c0dd9496b19ba9536a78a43a97704e7d4bef3c901d196ed385e771366682819d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\_ctypes.pyd
        • Size 125KB
        • SHA256 a8703f949c9520b76cb1875d1176a23a2b3ef1d652d6dfac6e1de46dc08b2aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\_decimal.pyd
        • Size 265KB
        • SHA256 c6eb532da62a115ae75f58766b632e005140a2e7c9c67a77564f1804685a377f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\_hashlib.pyd
        • Size 64KB
        • SHA256 c5b8c4582e201fef2d8cb2c8672d07b86dec31afb4a17b758dbfb2cff163b12f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\_lzma.pyd
        • Size 160KB
        • SHA256 6e571d93ce55d09583ec91c607883a43c1da3d4d36794d68c6ecd6bea4ab466a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\_socket.pyd
        • Size 79KB
        • SHA256 9e97b782b55400e5a914171817714bbbc713c0a396e30496c645fc82835e4b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-core-file-l1-2-0.dll
        • Size 18KB
        • SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-core-file-l2-1-0.dll
        • Size 18KB
        • SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-core-timezone-l1-1-0.dll
        • Size 18KB
        • SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-convert-l1-1-0.dll
        • Size 22KB
        • SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-heap-l1-1-0.dll
        • Size 18KB
        • SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-math-l1-1-0.dll
        • Size 27KB
        • SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\base_library.zip
        • Size 829KB
        • SHA256 83188d78653f9447107d011c1dff720fdb1e8da395f061e0e4170f6535c66f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\python39.dll
        • Size 4.3MB
        • SHA256 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\select.pyd
        • Size 29KB
        • SHA256 71ed480da28968a7fd07934e222ae87d943677468936fd419803280d0cad07f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\ucrtbase.dll
        • Size 973KB
        • SHA256 4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI33522\unicodedata.pyd
        • Size 1.1MB
        • SHA256 3a0987025f1cf2111dc6e4f59402073ba123d7436d809ee4198b4e7bfb8cb868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download