Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 16:50
Behavioral task
behavioral1
Sample
TaoFileTxt.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
TaoFileTxt.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target TaoFileTxt.exe
- Size 7.9MB
- Sample261030-vccteaex7q
- SHA256 e70f7131d05e504b9a0a2fd5e9b7b1a1c46b0cb9b1cfaaa2081e52b6a68e47a7
- MD5 12db57c5dbd3aa855850633789f32d37
- SHA1 2b55297288c8c0bb020e27958a1fb9ea2f47b5d1
- SHA512 2acddbed50855afd836c97457eeac4131add2d3f4c3ae86f183c452039b201f710d48c8275e14b453feca2a2e8fa19b30274c82ffe5ffd75c0c91b350a44cc2e
- SSDEEP 196608:yHGi9NTwhLQmnGCxdGjP5Gi2bjKVPy2wEak0ax82LEQNwuCppAX:yH7qLZnGCnGjMi2bjRouaxXLEkwZAX
- TLSH T13C8633B1A5C200F2EAD3C138EDE3A46AD2B1FC331375D5EF16A152951E272F1583AB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 2516 TaoFileTxt.exe 2516 TaoFileTxt.exe 2516 TaoFileTxt.exe 2516 TaoFileTxt.exe 2516 TaoFileTxt.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4400 wrote to memory of 2516 4400 TaoFileTxt.exe 90
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI44002\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI44002\_bz2.pyd
- Size 84KB
- SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
- MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
- SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
- SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
- SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
- TLSH T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI44002\_lzma.pyd
- Size 155KB
- SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
- MD5 a6bd469ef44eb08284a417fd5aaa4096
- SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
- SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
- SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
- TLSH T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI44002\base_library.zip
- Size 1.3MB
- SHA256 ff143623a9c7451da0caad46a846093ff311f808a05d7e30d3534cd60a23ae8f
- MD5 5dbc4c864b9cea9869b735132796105e
- SHA1 92a863d1f0cba32e20ac91a63dae3c1248fbf307
- SHA512 12ae8718d3ff41906bb3cd17e3922561c532c5a15b8896d22cc82513ec37d7f0386a03f4fa8752b74f8ececb7eb73b38de9dbf3ae077cf399cb1644211141ba5
- SSDEEP 12288:3uIva80201jwCVRDVoioSYGdjdTrpagW7Wpg6ziOlRL+DbwsE9htYzGN8TxJFw3R:3KdZlK7WpAwWSuTxJFwpB5cPPdxhY/
- TLSH T186651982B9527953FF54F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI44002\python313.dll
- Size 5.8MB
- SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
- MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
- SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
- SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
- SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
- TLSH T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI44002\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH