Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 17:06
Behavioral task
behavioral1
Sample
Varin-Sniper.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Varin-Sniper.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target Varin-Sniper.exe
- Size 14.0MB
- Sample261027-vmwn9sts8n
- SHA256 a3fb5fb73d9913e67ed5f00d624472d59d10072c1c9d34dd254566d1acba8a33
- MD5 2265d03c9cbeb86d30483b4cef4c4ce4
- SHA1 81972ae3362dec1836de6de83d8c107c1844ec6d
- SHA512 9c91f924a5d4fa88593a2e80eca65fd13a94a800092792957bfb9d2ee6c59bcbe78670c5c088f99da91611803ae5d0483040b99f3b3aadf0e1f2b12aa2a07455
- SSDEEP 393216:m9693pW8NLWu0mhHTodRGkXe+9v9AaxI2BL0A:xbW8NX0I0LhXbiaxj2A
- TLSH T117E6339577E5C4F8FE5AB23844820716A3B5B4212760C7C70BFA09923D731E4EE71BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe 4468 Varin-Sniper.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2528 wrote to memory of 4468 2528 Varin-Sniper.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Varin-Sniper.exe"C:\Users\Admin\AppData\Local\Temp\Varin-Sniper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\Varin-Sniper.exe"C:\Users\Admin\AppData\Local\Temp\Varin-Sniper.exe"2⤵
- Loads dropped DLL
PID:4468
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
- MD5 2be172c3086efe56c7e1d3279142295a
- SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
- SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
- SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
- TLSH T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\_lzma.pyd
- Size 157KB
- SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
- MD5 7c25a079b992919cc97221955dac050c
- SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
- SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
- SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
- TLSH T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\_queue.pyd
- Size 32KB
- SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
- MD5 6ffc75670dfed859cc7ca266bcc89816
- SHA1 5a39c3fd8fb398234611b91a5da260547442da52
- SHA512 d26d74232dce6c6e57c92a0cfae605bbef7036dd848a04ca8b267aeee1aa12b1b06813746466ce186c363b3c89034424ee64681399b8d00f4d4e997abfef475b
- SSDEEP 768:eVzlP6rT1wyzklIWQUFOytxJEKrLy2Ip44Cxf1mljr8VMSU:eTST1lzklIWQU4ytH/9pfI38VMJ
- TLSH T164E29FCAAE644047E563CA70C2E7EE93F935B7935601879F2065C18E1F237C1E726329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\_tcl_data\encoding\cp1252.enc
- Size 1KB
- SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
- MD5 e9117326c06fee02c478027cb625c7d8
- SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
- SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
- TLSH T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\_tkinter.pyd
- Size 66KB
- SHA256 ed2f7b2c9984032cfb046923b45bb745f6e819730c086e559777665b45e8390e
- MD5 7184d0da3bc7000ff02f3ca417924866
- SHA1 c6862df017f8f6234f89b1fcb12f87660d644ad3
- SHA512 ece03c7a9411a1bdb0b92378b4234ed9af69ee486a22e58463fd9b9c8a7805dcae45445fe831840c14476ab1346b142b8bbed76cd2f1588549377a4ee981f5c8
- SSDEEP 1536:sibeqllslpw+Tq0W6/glU9owEVl3e+BIWOS3ytH/9sfIbR:siFTN+u0W6/glP3Vl3e+BIWOSUF
- TLSH T190638F9BA7A4008ADEA3C539C5779F13E575BA920A10A34F01E4D34A2F337E393AD714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\base_library.zip
- Size 1.3MB
- SHA256 70e404f97c6a7590e59b24f86bb45cf0a8a9eb5bbd895d53dcd0139022a71438
- MD5 727b6a47a0cc627852f591ff30a54773
- SHA1 61a328214afc17a8e520cea70e732c26081a4c08
- SHA512 bd46b555d1aa5b3b94715306173ec9e57f8766f9d92134316e1b883ca83d711a71b1ee5611289b3ed368fe5720ade2f1183337cf93d76a3715338b820a130fd3
- SSDEEP 12288:RksoJ3XjmPT5EIe1eLfBHaLt8CiHBhJmB7qxfFECCHPZ4R5iCbuqTF:SZmPT5E5ufBHaJ8FHjoBqbF
- TLSH T1C155D7C07582B5B3FC84F3FA44260A0EA3658572BF45D747399F85E56F8B2A49EA04CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\tcl86t.dll
- Size 1.8MB
- SHA256 b894e0c9a7d2b56f9f202de5044221cfc0938cbd9ffaca6b6793bba486e28081
- MD5 10fe860df8a1952e1eb794a9c1a76e55
- SHA1 bb998de5efa9f16fe71d617dedcc778dda899789
- SHA512 a63983d81f3299d66dd888f798e71f66e942291f5b765185b1efdd99db48034d12d21e2e3440ed471acfbf5d3e220c68580f3d86e9f1c60894780379361fbf70
- SSDEEP 49152:N0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGe:+BUqMR7i6x9T+e
- TLSH T105859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\tk86t.dll
- Size 1.5MB
- SHA256 3883976d6270c44cf43b0f4e3b925259a36c42f586680a93dfe6a3fdfb5b4939
- MD5 58b94fa5c20956a4b2de750cce8681aa
- SHA1 75e0a64275f2f0919cf1eadccbad41dc81705d2c
- SHA512 e517f132d5b2b28b65963db76aad9d00dc02c5c9513a38db9deb1d003d19db0f1b671c486e5cc2cb4a1d5eb9e977ea1ccc7c3f214e98461b38dd085429fb2113
- SSDEEP 49152:176DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezfG:SQchLNqaJvARxr9DrTwylL1y5BEq8JTR
- TLSH T1EB754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000009e02\zlib1.dll
- Size 144KB
- SHA256 a3a9487dd7a27be0296731513a5c1d9005bd3acf5861ccbe0aabca3984f51c4f
- MD5 4d802db6ab2f497b2ce6b2f836543fe2
- SHA1 7887e35709b01b489269b5ca123d198c012f8fa6
- SHA512 3a5627d09e880eb70419c1e8e8cce4403a5213d5162a500bd6b973bf31fab3427c83195190233ff2697a13ab3082621825a6c8123153f835a67090eeed6d819c
- SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJC2KdT:0sVD+RrFgvi7JuT
- TLSH T1B4E37D9BB6A225BDC677817042E6C776F932B8214B3099EF5088D7741A12F806B197FC
- MD5 SHA1 SHA512 SSDEEP TLSH