Analysis
- user interaction
yes - max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 17:02
Behavioral task
behavioral1
Sample
verity.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
verity.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target verity.exe
- Size 31.7MB
- Sample261029-vkeyqsds6s
- SHA256 49475cd5849e1e8fc9295f704a547841fe49cc773b0cd301ef28674a5138a5cd
- MD5 c94796cdf3dd73ca2989f92079d5ee10
- SHA1 477c831a4cb11dfc86ad32b933112881c4c056f5
- SHA512 ebdb0a893e733be7745e1dc60f28971f8bb41dab2412677c402bdd1b875c55e11c2f3913f02475867972ae6a0f1ec5fc40316e2c43c658b7a8d576bd283c6001
- SSDEEP 786432:4BedveMvuq+S9+OWrhsqP6bxW2S3BKKoECziHVB/WjfQT:481hvuScOWrfP6iBKhEmM/
- TLSH T165773390FBC550FBD5FB803E9467C531FBB2B92413D0899F1A9817926E237C29334A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe 4844 verity.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2940 wrote to memory of 4844 2940 verity.exe 89
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\_bz2.pyd
- Size 84KB
- SHA256 37cbaeff9be4494f682eafe4adb642178f9c7277d4cda9ec343cfc06849a263b
- MD5 e3035138d1373e96e169e4c446b18e76
- SHA1 101cd23556bc0a8c4728460c4bf0bd15fa0f3d7e
- SHA512 935bafffde5f9e90f866533c863087fdca6df0e176906aad2c7fef4325df2eeb4ae2bc4eaa24096425679c2196feef48c0061392fd5b7a13d5957d37f93f4c47
- SSDEEP 1536:8ssutY90GtePwhFjKjBSnLYK9EJG8jKMi+gIP3VQyjKdLi92t+fIzoG4Zbu:btw0GtePwbuByY2SxuMi+gIP3V2t/EC
- TLSH T109835C52AB7416BAF22B917816B043A3F730BB65172057EFB2C485552F13FD1AE303A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\_ctypes.pyd
- Size 139KB
- SHA256 746cf693e04ceb5f5468cbd7d1cbd535403693e421dad0d34ff77a25b171bc20
- MD5 d9613a6cc7eeab428957c666ecdcb8b3
- SHA1 ed9ac7f748a1000ba886490f3477d97602f4f4d2
- SHA512 c70af6817bd4053a251364d436470e4f18d6637fd8684a3a9ab0e8da060f7f5aad06b1ab90d35ed7f8ccb4cbc4b755361d7b8e56357dc8e2e7c7bb688be643a4
- SSDEEP 3072:a+oHacqjRXPAuvs2FisZiY70m6FrpOEOq57ze3zxOE8pN3z3xYZjEcIPGP+JE:5nY6i6QreM7zOgT3kjEk
- TLSH T141E35B4B739800A6DB638178C5B39A47EBB1F4516B2053CF0164C99A2F637E2AE3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\_lzma.pyd
- Size 167KB
- SHA256 cfe42690aac2065f94d9e7df8cf53c523fdce787b9cb1593abe0190ae1d5891b
- MD5 008e6abc565ed25cfadbdf61cf81dc3e
- SHA1 6288e84fa1436348cf615550283ccedc5ef0dd25
- SHA512 401f346436ef67a980e8e8dcd8e4d303374129000a174fe027d535775ba45cc0fba7f4ef1fc24b1d7a82fa7076d7bf91e4f6a0753c04e466d7e64910818e1ad3
- SSDEEP 3072:3sRr+8GAgJ6wLtOGq8YQpsrL0znf19mNoDx5PExmP+gIPI1Ug:3sRr+MgJ6wB67Q0qtYODvE4Wk
- TLSH T12BF32991B258F0D6F3328C34CA964F63E6F97805432092DB018D977D6A2FBE59A76313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\_socket.pyd
- Size 86KB
- SHA256 a8a469df1c4fadfad6a72d379e1af7591e552c9c24aba0ca3dfd8e2ba8bfdb91
- MD5 2466924026b846b9dd3049a55405972f
- SHA1 e5144b9c4e33355b36b80c010c877aa3f4fb66f5
- SHA512 a23ae0c389785b480c02fa91c71743a7f4f267c8740b3edbd5a7fd628ee558460cf47067df4cd755fe294e85e0a8bb32483cad9c3101cd6cc0e6b330b09e33eb
- SSDEEP 1536:ZTFMxL96MDsyiuK7Oc4M0ypYHiXA+6Xwwzckrf4PcktcIPGwfHyjKdLi9kfIE14:TelsGK6c4HypYHiXAzXwwz1D4EktcIPo
- TLSH T1ED835901A6A041F6EB729175C2638E63FF74B4C11394A7DF1466C65A1F333C2BE3AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\_zstd.pyd
- Size 494KB
- SHA256 229e2029d167490a4fc95def7ca1670aee358a732cae13285478e74b8ce2f1d1
- MD5 4823a9040f63d6cc4cc158d01001f590
- SHA1 c88639308123386222924839700f5221a07f351b
- SHA512 c4235f15f7d2a060f016a734e32a6e71995618e60fabf689538995028e9d45e026b70b62427d61914c458b7d24c1927d38115ae87d5f3b2f6605ed54b3aba882
- SSDEEP 12288:j8c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEg5BCl9VEHS:j8DMn0tWRkBFuYHDtS
- TLSH T1E2B49E43F25943ECD437C4B4CA5A9613FBB6B84A2214525793A5DFA83F03B31DB2A319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\base_library.zip
- Size 1.4MB
- SHA256 390f0113ec897083f66dd9f13cce1b1ad4807d9328d267655f899c7725d10027
- MD5 ddb5ddc096d40dc68370ff216ecded0b
- SHA1 a2b2d0225fe9535c7c1ba8721a5f7ea581c86fdb
- SHA512 5e45a2dc5a2618d2599c3474256996dfd59db9fd4f1ffb989279c52c64c204960c63a4ccff6375bd210ad80add69da2d4d109b0d9ae4bef7bd56eee372f0f0f6
- SSDEEP 24576:Je9zUVr7AcoBFw5t7Q92ZosCxeGXP2m25af/IY:Je9zUVPEFh9xsCceJ
- TLSH T101653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\python3.dll
- Size 74KB
- SHA256 67af820b620d119f85cbc3f7d494166b443d87b7a04e047dee0bc92502161bc9
- MD5 15398f8bb032f7661cd9cc3cf59f1a73
- SHA1 8de06bc6dd7d822e793bbb078374b01ec0b0041c
- SHA512 f94133e7202075c9bd25a2216ca5d85a4e97f5f259a906f6cb4c7e64129d445dfc84ac20e52f3367b9194f37784986cae14edfb3478041d9992ec3e54d4b6346
- SSDEEP 1536:+2+7QHQnnBjKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/89Pf:yQGcIPG0XjP
- TLSH T1B3731C525B54F8E2DAB627FC7893998D1F2B12CC83298C9C647D93D20DDA313A62734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b7c2\python315.dll
- Size 7.5MB
- SHA256 ca4f7b4823ca187f4a6483fba9f21804390a183b783ee2bf9b5ab75d98f62c3b
- MD5 3a9d7ffd3b407879f13fee566e523e62
- SHA1 8e4b7dd597608f8e421995fd980452eb199731be
- SHA512 de27b06ca9ad246bd10f9d6921f7bd4ea53558fc889f59111ad9a7072302f055ca8f9ed55b7dba5b850d3e5fe47de8c35d9eadb422a29c8590966511d4bd1444
- SSDEEP 98304:3RFyy6m+gxchUIywFr8dyGL2MOa5FuEhv5HDMiEp0+J:3RFr6thUIyw18dyNMOOyiF+J
- TLSH T1D5867B3A73A511A4D87BC036C5434647EBB1BC10AB20D2CB52547A9A2F337E35BFA725
- MD5 SHA1 SHA512 SSDEEP TLSH