Overview

overview

7

Static

static

3

Z-VPN.exe

windows10-2004-x64

7

Z-VPN.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 00:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Z-VPN.exe
  • Size 44.2MB
  • Sample261102-aga56adf79
  • SHA256 8dbf88d784109d487a0c973c30ead2ab30aa56369ec9a72bad0adc89a3745abd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Z-VPN.exe
    "C:\Users\Admin\AppData\Local\Temp\Z-VPN.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Users\Admin\AppData\Local\Temp\Z-VPN.exe
      "C:\Users\Admin\AppData\Local\Temp\Z-VPN.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: AddClipboardFormatListener
      PID:5320

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\MSVCP140_1.dll
        • Size 26KB
        • SHA256 2be87527c41e1ba8aff48e326e0adcd4743516e0bbcc9304986c726e27de6aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\MSVCP140_2.dll
        • Size 265KB
        • SHA256 6a72ed8a87eae1671640bd1ca98eccb989f1772ae46ab84594e385bf6d4ac4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\Qt6Core.dll
        • Size 10.0MB
        • SHA256 f57ed38afd95d0306cca9d88d997f639f70c7628a4f1f064eae291d579487121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\Qt6Gui.dll
        • Size 9.2MB
        • SHA256 abd20026e190e8cc69667d1bea042db05cd353cc05e7da74b063c20b7da3f6cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\Qt6Widgets.dll
        • Size 6.2MB
        • SHA256 2f62cbe2869fff4e20df7369c2786e1ec7ec290d5a63d1371b7f70cf06909c3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\QtCore.pyd
        • Size 3.4MB
        • SHA256 6486f6f0a2fec42fc8c652c0b76bb3ad0d44eaccad9c72e577116a075681eebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\QtGui.pyd
        • Size 3.8MB
        • SHA256 9ac544d1bcf8a26c408c63090d05506f8382d5378ee3a204e29a3ac5449c5b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\QtWidgets.pyd
        • Size 4.7MB
        • SHA256 a8e323e56a93c1a8a70981c36a409c0a2546e7a08da5be8ca4e03dfd27febc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qdirect2d.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\plugins\platforms\qdirect2d.dll
        • Size 1.0MB
        • SHA256 18213464be5a5a1d39af6a2c876ce21a6bb6a634c814651d09f0ef7e4719edc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\plugins\platforms\qminimal.dll
        • Size 60KB
        • SHA256 c9025bc5f4653c5aadac87f06ab391763e82adf792f6759c6027a78a5efcaf5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\plugins\platforms\qoffscreen.dll
        • Size 109KB
        • SHA256 d24ef380ab0882d39f21539dcf57ab4213875a6fc658a53012f2d2fd275c6f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\plugins\platforms\qwindows.dll
        • Size 978KB
        • SHA256 ddd5cf6a96f058cfafcbc901ddeb5df010d755f0716beacfb557f8b27b733afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmodernwindowsstyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\plugins\styles\qmodernwindowsstyle.dll
        • Size 235KB
        • SHA256 74d4c47b56a942afb3723bb105900501bb8f91a46a8b592fa722cc4fdb2ce9bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\PySide6\pyside6.abi3.dll
        • Size 256KB
        • SHA256 d5b87ccb0a7c305854bd120242b0a75002d0b50a35532d0f6171e4ed0f3cc82a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\_bz2.pyd
        • Size 83KB
        • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\_ctypes.pyd
        • Size 122KB
        • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\_hashlib.pyd
        • Size 64KB
        • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\_lzma.pyd
        • Size 156KB
        • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\_socket.pyd
        • Size 81KB
        • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\_ssl.pyd
        • Size 174KB
        • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\base_library.zip
        • Size 1.3MB
        • SHA256 a979f50430d2854409a4990cd6db20eca6377d17861a9021670c51023ede4510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\python3.DLL
        • Size 66KB
        • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\python312.dll
        • Size 6.6MB
        • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\select.pyd
        • Size 30KB
        • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\shiboken6\MSVCP140.dll
        • Size 536KB
        • SHA256 1ba4d7c0a95d375da138a057a57593b33510ad5bda6c5e2686afd68faa5b4231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 8ccf415b2cefb5b6462504581ab1993fb41afe04e415931d8a72049f1c79b267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\shiboken6\VCRUNTIME140_1.dll
        • Size 40KB
        • SHA256 f02cd4a862b85a9a3153d27e15e5a213f5df8e3d77004ed2e87b8a7e8873d97c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\shiboken6\shiboken6.abi3.dll
        • Size 390KB
        • SHA256 07c318c02be5a3a9f1475f5a2d0cd438f4d4ea3288c28e2e10bc5ebbbec8de86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cec2\unicodedata.pyd
        • Size 1.1MB
        • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5320-230-0x00000266BFFA0000-0x00000266BFFB0000-memory.dmp
        Download

        memory/5320-225-0x00007FFB039D0000-0x00007FFB03D94000-memory.dmp
        Download

        memory/5320-222-0x00007FFB03DA0000-0x00007FFB043DB000-memory.dmp
        Download

        memory/5320-200-0x00007FFB06130000-0x00007FFB06491000-memory.dmp
        Download

        memory/5320-221-0x00007FFB04D40000-0x00007FFB05207000-memory.dmp
        Download