f6beab8402c2d828183ba2cc22b990e4280bcff40bc7bd396f84e933e1499479

Analysis

user interaction
yes
max time kernel
4s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.exe
Size 17.0MB
Sample261027-lsdafacz9m
SHA256 f6beab8402c2d828183ba2cc22b990e4280bcff40bc7bd396f84e933e1499479
MD5 e001092f5f1ae324dd9dfc817f3cfbb9
SHA1 208d6c929981c788145fe1fd2bb4a123a09e1c65
SHA512 0f5eaaaf9efecc86347e061852a3a2e0f195b9bc0e8dc0c9c602f667df3ffad5805c991935d074a72b0c325fcd30689da431187b8972bd48f4278efb05942d17
SSDEEP 393216:uRcSKly1pw6e5yjPZE34JayshUsQQmGbV/3JKKgodjP++bPpW:qcNly7w6t+OZQ9bN9godW+bPA
TLSH
T16707335696C122D2F8F3E63D19F3D018E670BC059FE684DB06E5A0462D27BD76A3C362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 18 IoCs

pid	Process
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe
2284	main.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	main.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	main.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	main.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2284	1672	main.exe	91

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\_bz2.pyd
Size 85KB
SHA256 2db8c279a6976dd74faae4f8b1a3749727976f3928a350f7a45e9b7deca5e2b0
MD5 d43c87366239492e4f3a2f15b0ad3632
SHA1 a7116d129f079d1edef7b70926726a2b46d01ac0
SHA512 88f4a2af38781471d426d0de313f61b267807f9a83beda3046030e969813c59969364e280c4b7092fea02168986e6c16aeb172730aac10c1f0b1dfdffd254184
SSDEEP 1536:ftMtz7eksNCbQYVVEFxO2RqOyuzotOw8mUbIi0IH3VsXyrAa9xfIZgkU:lMtzSq0rjOqqfgotOrmYIi0IH3VsTE
TLSH
T1C1838E82F3B062B6F59F81B4D6914353F730BF960710A3AFB25482963F12B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\_ctypes.pyd
Size 139KB
SHA256 c1b0ec4243d3d729456e608426bd17e3934b266bb9271a6dd83b360ddc454936
MD5 350c3d008651d27d0f3e789f4597a1b8
SHA1 0719ecfe1b98e46d2b2d4c8d6c96408dc03465cc
SHA512 7910d4a8bc2b1529d7fc19a03d6d10afb02da8e5eb7574e5ddb443ed5caca95764431e1903f6c34775b89dd0cb7f80024f6a11ece0e982a51314ccb1ad153df9
SSDEEP 3072:N601Nk210amJuixi+m1O8I+pim9AR/OgIHGPTv:0YNk2Xmi+J8I+EkuOG
TLSH
T1C6E37E4B336840A6DAA78138C5739E47EBF1F4522A50938F41A4C99B2F533A26F3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\_lzma.pyd
Size 157KB
SHA256 7e64fbe55b5fd705f20fd1936ed23356956496d9a5882846850c32800e61d554
MD5 15ce484c0e04766690236236a4a73cb2
SHA1 81d5156370d42855c2d71fc3c893270ce7b008b8
SHA512 bea4ad07e88da99640eb59fc466fbed2b0bea6f2b8bc18ced14cb84b20eb2f7e438f2a26eb7c73e0ab3e153206706c225c1e0f5d6c880bd2995d847f9635ccab
SSDEEP 3072:FJ66g4T5QW7JfyjEqkSkA51b4oznfJ9mNoVU7sb0IHI1I7Cq:FUR4Tp4QPZ8N4exYOjbr7P
TLSH
T1D4F34C86B794F0E6F7728C38D2614F57E6F5781A0320929A01CC976D2B1FB759E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\_socket.pyd
Size 85KB
SHA256 1bcb3758cacabea4d10350aa776b8192881b66130ed61e514a6d0ef6ab984a2e
MD5 69a932aa51fca06e9878bfaa63d6130d
SHA1 4bd87656aad25b03d8d4bd5cda0911d1bd99daad
SHA512 f33b91386afacf09b6b4dc330deb193d7fc3cc8822ae05c9fffc080579fecaf553c5a9c44f952b79d588335d77a7354275ccf87ea9cef44117f6bda3a80e90ba
SSDEEP 1536:yhGbog/H3uN1XG4eAypxv7XP+66wSzpN/ab4etbaQtcswPRpbgIHGwVyrAa9wfIE:9bogf3Mypxv7XPz6wSzpkbtaQes8dgIj
TLSH
T18F835A01AA6040F6EB72C176C2679E23FF74B5C11294A35F5466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\_uuid.pyd
Size 27KB
SHA256 701d4cdc77b9a0fdb4f9c38ac5df5bb940dc07ef6ee1a3cbe8fb78b2310eedf0
MD5 dc529ae65c95b7ac74b2215764a5a2c6
SHA1 154f8fb5a17fd7886cac4b8e8ee6361d1312e6ba
SHA512 bff6500a3e466d356d8fb67ecb0ae839afe61961a128c601578699e87ac307b156975817241a6078032fe966694d2257e0b7aae694faf75209fad48fb0bf732b
SSDEEP 768:xJ15c0IHIwhyxZIXT2Ip43Txf1mlNNo2gPkAz:xJ15c0IHIwhyrAa99fIzolL
TLSH
T191D27E86EA784153FE974BB0C1F2DF43B939BBD35A108697316991851E133C2B3272AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\_zstd.pyd
Size 491KB
SHA256 473c52fdabf4e0741d91e1a3b1cd2b4b983bd62823832fd0386cec91b6914976
MD5 94924e7f07b0c5194e3c31c50fa1a211
SHA1 bb9c762aeb00c583439c8f673ba55d289a511bd0
SHA512 6c14896cdecbb7de9c08c3ecd14c2c54fe996e36b0aee71a568bafcb9949d6a9e75df63393c09d1a3c188c58316b4bf27dc6ff60a6dfb8e16f06ee3f702c0c3f
SSDEEP 6144:eoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFEO5+SClJ:1RFcemgqKP2eeVC2Lz9kQeO5BCl9VaxO
TLSH
T1F0B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B93A5CB993F07B309A69309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\base_library.zip
Size 1.3MB
SHA256 51ba35051af230c10f3c9c0d6ee9d1fe6c072bde54a20391364d13b2d3b4301d
MD5 b53728a40010ce9839bb7de595312e7f
SHA1 bab080474b09ff0f725f038a70105d41af899c01
SHA512 834e619cc5dc4fb85187c311701be6ff4d3311f248d3635383a6ee4ef6c6b377512e054c9acb49590f2735b4764ccf268be44963bed29d37ccc57f361465b838
SSDEEP 24576:RL7ZQeOdP2m2dfWdKRZouUF4DZGlb5y/uYYHC:v/+dKRauUF4tuYd
TLSH
T142552A91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\python3.dll
Size 72KB
SHA256 f1af2c16d941d55fea8cc2e7afceb9948649d5ce58ca6e49392b947b6015caa8
MD5 17a7fba7651f4536ffdcae9d8e0f733f
SHA1 586ba3d3896b08f21ad803f1e90c813982502987
SHA512 b9bf02a0c1c1d5ff9a8c241deac5af019a957b92252921e15405d94d51c08817dbb09255e27b0202d6e01a5d233f99e1fa574b3a3f3a5600bae1385787e7dc5b
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI6:vbTrnXngXMUgIHG0oyrAa9vfIzoOYv
TLSH
T1FC733B5E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\python314.dll
Size 6.5MB
SHA256 6a0abe3e09cf7896c54b5b065c9a268f6545d3ca93437f7e55b9f8258bf0bc18
MD5 6bbf0544bafbdbab02244d87a95002a1
SHA1 61787dfb42bdb49dab1c1c9e5f1a28b42c8ce9e3
SHA512 6c31ebfdd5f6b6e1fe597c71964bafc1d902dd8903490aa7488eadcddb3d1318de05fa11b2b72923f914516dcdddd9110ce583fe33f0f32f58970581dde405e1
SSDEEP 98304:DjKGZwazFUJgAV9Wq+sWz04Z3MykhIvrHDMiE4y:DjKY5zFUJgA+q+sc1AiA
TLSH
T1C9668D66727511A4D8BBC435C9034647DBB1BC00AB30D34B49A47ADA3F733639BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\pywin32_system32\pythoncom314.dll
Size 678KB
SHA256 4b22e2098ef244548f7d1b9723eb6d76d359d91ea52215bbef08c0e763a59043
MD5 126ed8bf5b62d2edcad2330d6e524336
SHA1 63b972c51fa645605cbb95f9749c22659246d168
SHA512 c44bcaedb18dc7c3f8763a98e4ce4457df7e541f3331574397d15ba4bc55a8aa66115c13f55ebaefb20333fefdb0445695cfe39f0d2bd076aa77d33cc7871180
SSDEEP 6144:b8VT5uvOeuLG1NgYPxezI1l5zqDFWYmaJXSASu+Jps84+Npd7hEXtsF8rD:I9Dts5eUjBOfyu+hvpdFa
TLSH
T1BCE44C56B7EA0991F62A907ECD138B03D3A2F4510791A3CB01A0C76F4FA73D52B7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\pywin32_system32\pywintypes314.dll
Size 133KB
SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
MD5 c11818bd607c6060902836c3f6bf024a
SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
TLSH
T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\win32\win32api.pyd
Size 136KB
SHA256 9004920e2c7863c34d0b3c4183ab3e1482475817cfb64f4f198e1fdd43f48f4e
MD5 28b70b1aa326df930246f099d93e5ab1
SHA1 c491c685c0a31901bc708aaef777d44cc157bb94
SHA512 ff991de71f9301171dad8f35d2198eadbe747257983fcd2b584adbdc5ba8c88dc3fed44d7b3d191302c3a2c7bb3cc76d7750e5c8b0d01f082c7d09c02dd42673
SSDEEP 3072:8ZW08k/WhmOEYlRVlhLaN/P3MXKqTmW/gD49jEYe:s8wWhmilRVsP3xqlUGjE
TLSH
T137D31883B39900D6D8AAA3BCC4674E63D736B4200721A7CF06A0C18B1F677E97D79795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006882\win32\win32event.pyd
Size 29KB
SHA256 f16242b661c20f510ea13fa3dcac5bd332bccb4d135ef2ab497b3f3f3398c389
MD5 eb732ce13f0fb8520010b2e7ebfc5a59
SHA1 3eb1b902fb7f0a3b31005c94d7b5d1e745e75b02
SHA512 b2143474881e34be4b282e8f389048340e98631de8c5dba6aa26c2bd63a70f602b0cd55b3fcbf95ea80e154c2134cd59dd34f0fabb88651c75581ac6c94eb199
SSDEEP 768:F9WgtT0f52Pqq0+rxcF/jhfWddbcrlcb6OTfmku36ucaZ:FZhNcF/jhfWddbcCGOTfmku36faZ
TLSH
T11CD2F78723A850D5E526D17DC8660F47E6B6B93103A0B3DF0252D55A1F733E17A38F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-95-0x0000020A90530000-0x0000020A90C28000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads