Overview

overview

7

Static

static

3

CheckERB_download.7z

windows10-2004-x64

1

CheckERB_download.7z

windows11-ltsc_2024-x64

1

Custodian.txt

windows10-2004-x64

1

Custodian.txt

windows11-ltsc_2024-x64

1

checkERB_d...le.exe

windows10-2004-x64

7

checkERB_d...le.exe

windows11-ltsc_2024-x64

7

checkERB_w...le.pyc

windows10-2004-x64

3

checkERB_w...le.pyc

windows11-ltsc_2024-x64

3

chromedriver.exe

windows10-2004-x64

1

readMe.docx

windows10-2004-x64

1

readMe.docx

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 13:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    checkERB_downloadfile.exe
  • Size 31.3MB
  • Sample261027-qq67ysdf69
  • SHA256 a3b2ab11ee973b4f2e75c50edabe3715fbc86edfd9d76d9b34f3bb4fa5eb8236
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\checkERB_downloadfile.exe
    "C:\Users\Admin\AppData\Local\Temp\checkERB_downloadfile.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\checkERB_downloadfile.exe
      "C:\Users\Admin\AppData\Local\Temp\checkERB_downloadfile.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:3216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_asyncio.pyd
        • Size 62KB
        • SHA256 1ce6b39138cb7403cc2c04b2611b4599359ab8a9c89178d68ec0b0142ba43dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_bz2.pyd
        • Size 72KB
        • SHA256 52089210a371bae9fb48cff98733c31edc3d3c3173b7751802302ffd639e1521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_ctypes.pyd
        • Size 127KB
        • SHA256 3b3c3320c02cc09d1ce6ae0d870e7702c4e8ff46eb93907dbf2096f79441895f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_hashlib.pyd
        • Size 54KB
        • SHA256 dd67099a7f6de1ef923c726b6aea8628dd33dd8b5be3da14d31e9492eacac4d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_lzma.pyd
        • Size 149KB
        • SHA256 e7182f4ee8960d2ea2d0646b200a281a2be60d4f630431d684d3023365fd2bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_multiprocessing.pyd
        • Size 24KB
        • SHA256 f79ee8fd9fe3efc8be4eefca64d1a7251417f30ac865d7c7464053f2587368c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_overlapped.pyd
        • Size 43KB
        • SHA256 53a7bae62e35499586be4e20376d4741e3cac87b07b5048bc878670377fa42d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_queue.pyd
        • Size 22KB
        • SHA256 3ed16b83ffa6318912dfea0e88d78d4a25a389142fdbb901208b845710181810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_socket.pyd
        • Size 71KB
        • SHA256 43ed68c4b45840d442b66bb8f8cc65b77a0a7afb6f124aa6c45e4b5a6136fc10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_ssl.pyd
        • Size 172KB
        • SHA256 f485af3125a407c5e1e176387ceaf552e3c9315eb23b6dfd22e5997d833a69a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_tkinter.pyd
        • Size 54KB
        • SHA256 36f874e5b005c702d5e07b31590622e9aca92d79ec520cea4759a7e39400b9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_uuid.pyd
        • Size 13KB
        • SHA256 ae5f5897357ba1f19fabf637e007ba635d1719208caf744647c00b939eaa314e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_wmi.pyd
        • Size 25KB
        • SHA256 3b852ff15632888e4849707f26e608f4cabea683ee3054fe39d2afb9b088aad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\_zstd.pyd
        • Size 478KB
        • SHA256 bf7da707444f726ef4bb76ce7141230c89a96e987c2adbf0dad85da18c15edef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\base_library.zip
        • Size 1.3MB
        • SHA256 58c1f48eb4e5d054532b3d9176b31f17968481e8b2278317b7053c299b805cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\charset_normalizer\cd.cp314-win_amd64.pyd
        • Size 116KB
        • SHA256 2fc82a309cdd4499e5dba1a87671f9ac3a3a35e44008afafd7867888d400f3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\charset_normalizer\md.cp314-win_amd64.pyd
        • Size 206KB
        • SHA256 ca72897ac6a6aca48bac72b409bb3cbe6326b755b37d733cad731d5624e17f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 fe2eb37aeb3004e78bb31be2f116f9f09353b2b822f01c8aa333b0b923cdf4b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\libffi-8.dll
        • Size 27KB
        • SHA256 42ea89b1f78f6cdf00d80cfa524eb418830ea4a8511359488ac5a1b67af2e4a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\libssl-3-x64.dll
        • Size 1.5MB
        • SHA256 da8846ccce75036db6a83c4e02774078b71f2046e06eba8b2577bad0d92c5e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementpath.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\lxml\_elementpath.cp314-win_amd64.pyd
        • Size 146KB
        • SHA256 222be8036ba2f3bea485a4f68b8f8f484ccd7197d96fd60518ab778854c3151a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        etree.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\lxml\etree.cp314-win_amd64.pyd
        • Size 3.9MB
        • SHA256 191eee78b34979c31ba08d952ca3cafabafe2f86d81adef19f0bcd4ad2ea53c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\python314.dll
        • Size 6.3MB
        • SHA256 dfbf119c3e43075d4c1b9651201607d97c2a6d1b82c4d408d677db94876db44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\select.pyd
        • Size 18KB
        • SHA256 4ece828c13921d5ea692a00f4ecd356e71c42a3fce2652c3f5d04e5e500f17be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\tcl86t.dll
        • Size 1.7MB
        • SHA256 adac4a4ebf3c696008e0467110e77e1893abf10f6284c1f50a4ac14b17553c10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\tk86t.dll
        • Size 1.5MB
        • SHA256 68cfe823b242145c1e6e92117843bb5b17f78974d0a5d5aeb0ef5234c59032d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\unicodedata.pyd
        • Size 727KB
        • SHA256 f27ab28ab35609ab1e7071b7d614770ce30cdb5da5296adb570c1d10e2f59d35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b8c2\zlib1.dll
        • Size 131KB
        • SHA256 76828f023f90a417632519c8f24f5af8999b4e598ffd5ddf4a1eae04a5744231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3216-1134-0x00007FFC5CC00000-0x00007FFC5CC29000-memory.dmp
        Download