Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 10:52
Behavioral task
behavioral1
Sample
hellogui.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
hellogui.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target hellogui.exe
- Size 11.9MB
- Sample261102-mylpfaeg76
- SHA256 69001e448aac238dcad21421a24cd39048428778367c10797fd2bfab9e017cd0
- MD5 54d1e1da691d6643ba3739acba8b8d79
- SHA1 06126d7469d69af8e04ec08984306e847ac99704
- SHA512 777dab3a9c9332c085ee02cb60450cce7c9b5021b6788ae78c1d0b413772a1a8ef2e321549f16bb826575d6b4c23ad57a1d68e452792fc6ada3c2702f4279875
- SSDEEP 196608:BKjUSbwtyjp7qejDFE3XIJ0uV1GmMUSFFwhqyS/gbeHV5PTmCY+QX98GMvbHFzA:eqyjPZE34J0unGmIFFXySoiHVBSC7AO/
- TLSH T1A1C63360E79095E6E8B790394CF3E012C161B6194B7296DF17840E7B3E372E28D3AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe 4876 hellogui.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5096 wrote to memory of 4876 5096 hellogui.exe 89
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\_bz2.pyd
- Size 85KB
- SHA256 b02f580daa0b390b2228d2a8186ef119be658c89cc64d0bd909550786ed993f2
- MD5 2301264d99e1f699ad99277198e33f60
- SHA1 3b5faaf13c5d41f7bf0cfa3133b109a275c71a1e
- SHA512 9521c78475bb769ae7da6c32b65076524868606c1540c88d76751e3b9d7d85abb176944fb556ceb336c71c8c38f3f3d240fdf46d0102fe7d82ca3cdd0a78db36
- SSDEEP 1536:u+BDlz7WQBcArn6vyZuZOpkVHMf1k8RUbozkIE3Vlyb2QS9+fIYa+:fBDlz0AOuoOpkWf13RYozkIE3VAAm
- TLSH T1E9838F92E36462F6F6AB81B4D2910753F731BB96031063AFB344C2853F12B91AF59365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\_lzma.pyd
- Size 157KB
- SHA256 9099ef451fe61d8feef9e02894902b88fdc8ee404e3f8b7412b150878c973803
- MD5 d74403a7a01d1081e1ada23bc68ea73d
- SHA1 8928cc6ddad888e8f793606bcf87880195b3740a
- SHA512 d238626870c290d690357e50c1d3d3fa99830caf9d95b9dbbd33c74b54c90108b7611733ae4939b9ea9ac95a87a563e04f201312491b84f894a1efbb81e28618
- SSDEEP 3072:AJ66g4T5QW7JfyjEqkSkA51b4DznfJ9mNogUIsbkIEI1FRaT7z:AUR4Tp4QPZ8N4/xYOVb3Uv
- TLSH T170F35C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\_tkinter.pyd
- Size 69KB
- SHA256 36675f9038cc1f1fea08b68ef38c5da94b41efbcd3a421421198f49f01afd8d0
- MD5 0aad7f83068dfe094174eda2a6e81c42
- SHA1 750a7fb9d7c43cc60ed5838c2424f37bbd324e5d
- SHA512 ed290592582597b9f3d615ebb2de322f91128fbfa1d4dbb08da46ba6034d01ba6806fbdf835c3a063c744b4136a37d4839e96d0a7ff5e7c951014eeca7382f33
- SSDEEP 1536:/3rQ5vzPC333f/x6pt33mZgZ0+jsIEDSlyb2QS9HfIkwx:/3slD233szGZgLsIEDSArb
- TLSH T135636D9B5768008AEEA3C139C5725F13E5B5B9625A20934F40A5C39E0F333F3A7BA751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\_zstd.pyd
- Size 491KB
- SHA256 526d977236cc63895902977f216bf3ca93a4233489240656b295eafb6f518d07
- MD5 3dbf9908e2bddd4346be7370bf6a8d87
- SHA1 ba5c0b6770b37943fafbf013bf575aaf461b73de
- SHA512 b87a623ad93fbf77500679f89daad61e9ee316d0fbc1e778d6a37e29f449c30ce108b24fca545a6ea6de8b9568c9fdee7b7f5ae54d51c7e6eb1ad0119f7348bf
- SSDEEP 6144:soRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFEK5+SClP:3RFcemgqKP2eeVC2Lz9kQeK5BCl9VdxX
- TLSH T111B48D43F29943EDE53BC4B8CF465A13FBB1780B1214964B97A5CB993F07B309A69309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\base_library.zip
- Size 1.3MB
- SHA256 719f0fc3a2579947090561cc88319f74c078ac7f6b7c40c2f27dbfa750444813
- MD5 dd18c6e728307dc1457e1e15ad3d8330
- SHA1 e85fc06b9172f97759e33b490467485727fc29e9
- SHA512 8fb782e294df2a2d78cc21ee48d494adda785347992e9001eb38ba94134353327015e12bbe92576f9b009ac22f64e579787e4c90d89a32e90a50c9367f3f3276
- SSDEEP 24576:e8YBLfQeOdP2m2df8lGDZglbuduzRZJuUFgl:jY1/5tdsRPuUF+
- TLSH T1A6552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\libtommath.dll
- Size 79KB
- SHA256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
- MD5 d905551350a3d711a5e72a284a07997b
- SHA1 4eb1261e90e19d241893e486aba6747a74d8b97f
- SHA512 35c92d493efe9a2296ba94a4e6851132ad826dfc749bce3fa9bdc9352855aae9bc57521e79ce7f49cfbf486bc15d5c767ed50ee70d966d568d639176350b689d
- SSDEEP 1536:03RaimSoWEBrh2as3iwaOasKuWoSvMD9NN:KqWEBkL3iwvrD9NN
- TLSH T184833907F6C620FEC05AD1B6C70A5322A6A2B8239B267BDF23016E255D55FD06F3F251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\python314.dll
- Size 6.5MB
- SHA256 854fe7549eb4b2ac478935a38ae2ca1b774c6fdc3d87f0263fbd697ff86d7149
- MD5 2e80dbbe49a92e731184c0b0893b220e
- SHA1 7aac631c5001ad6b1e6886a82e3c9e14215bd4f4
- SHA512 291c1d8fdc1973a5a439e59d03384a2b31d010cba357d37cf24c4706457b4277d66eac7f162d0208a5a1d255c6f8105c16972be439cb4a7877c90ea057b25f7b
- SSDEEP 98304:UUNfZZoy5opBcWVnrEYVISXP8YamvvxHDMiEAPIr7:UUNfZZo1IunrEEUziBIH
- TLSH T1CF668D66737801A5D9BB8035C9034647DBB1BC10AB30D34B49A4B6DA3F733635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\tcl90.dll
- Size 3.2MB
- SHA256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
- MD5 9bba592e4cf79745bad7d5ea9fd3c347
- SHA1 b9c21bde58be54333529c49d91c6a419e55abc6c
- SHA512 cb3f99cf47e7fa9a1bc124d5ee1b061bf3f13d9afd575a49040d3d4f03775b702d8a2e08b33e4ecfebceeebe334958b89d7ad0e6378f37768b142adebe4d0d75
- SSDEEP 49152:JLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugz:NWrPOVNFFvsJnNKfXAqRGYYM
- TLSH T1F2F5AE46EBA40068D5B7C27CC61ACD5BDFB274581364AADB14E05B612F73FD2237A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\tcl9tk90.dll
- Size 2.0MB
- SHA256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
- MD5 f07870b32f577cf36256def49d360787
- SHA1 c6311ef53589dc7937b4b2cf70782a785ab00f92
- SHA512 0e2ba98202d3610601298bde13de16dbc80d894c5b3d6f415f7d477b676d317eaa706d005b84e4884e1811dfb2366dec080857853f7fb52ad0e1244efa04c467
- SSDEEP 49152:q/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6y:os7+8JToVH+MQ
- TLSH T11FA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013e82\zlib1.dll
- Size 100KB
- SHA256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
- MD5 1377669a18e22b364fb390504e49260a
- SHA1 e42eb7900b11f952ce0cd808fb6e1662fe25c373
- SHA512 80538f4c1a64d3b8b0329610c44a2c61d696f4e880a61b935047e2291edcea29ab4bbb0c0a9af9247051690823d7699728ebb4474ac1639317af0c70e830f124
- SSDEEP 1536:zeKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fB:aNGH+X34najvon8PVh2FXws+Z
- TLSH T195A37D47799620ADC1BBC231D6E61B21E6B638400B2D1BE74284E7752F02FD06F797E9
- MD5 SHA1 SHA512 SSDEEP TLSH