Analysis
- max time kernel
148s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0d9a08de51da390.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0d9a08de51da390.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target a0d9a08de51da390.exe
- Size 13.0MB
- Sample261102-phj7safa39
- SHA256 a0d9a08de51da390408da4453b5212329bd2ec4d056fe4042eead315adfde2aa
- MD5 275940cc4b43e857662696243182d476
- SHA1 ec733512b8ff63562d795435c8812abac8d1a397
- SHA512 d36782ef13d608296427e59894272ab549b5d31d906fa5a4122b951a4758a82ea992f036b4bbdd354a6aaa127ca73ce412ed15b15fc23010d0345cd5f3e925ec
- SSDEEP 196608:GYM0MOBqxRg2zv5Vh4iVDwQ908kqZNRQlmk7ae/xKrDk36ZcW8QK3ChMpeZhk:TM0tqxljCXQG8RZJpe/xKrDk36V8QYW
- TLSH T1CED6334A95828494EE06E03AF784DEA5F3B9BA51475740B301F0B6F42D73CE0CAB957E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 17 IoCs
pid Process 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\garrysmod\cfg\afkbot_init.cfg a0d9a08de51da390.exe File opened for modification C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\garrysmod\cfg\autoexec.cfg a0d9a08de51da390.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe 4348 a0d9a08de51da390.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4348 a0d9a08de51da390.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3228 wrote to memory of 4348 3228 a0d9a08de51da390.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0d9a08de51da390.exe"C:\Users\Admin\AppData\Local\Temp\a0d9a08de51da390.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\a0d9a08de51da390.exeC:\Users\Admin\AppData\Local\Temp\a0d9a08de51da390.exe2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\_ctypes.pyd
- Size 140KB
- SHA256 8bb22628ae859877b1cf55381c1a8cf54bb0aa70c56295053bc3303262e21c87
- MD5 c0fee3bbcfed8b38c90d92f09d04ab66
- SHA1 ec963ff8051552922c6ea7fc0bc2f74d7b5494d7
- SHA512 8af707e4d74eacfd7d9e212f2f3498bf066521923bf34b4381742a0aac249da77c63d0ad15d8a808584eb28000f77dc2c265689d0eb218a054823e8387edd419
- SSDEEP 3072:kxRda0PxZNRuZscjpJCnwcJtgoGz32oyINYruKP5cIVGPCPY:MDQbIt3GzG/MYTG
- TLSH T1B7E35B4B335840AADA738178C6B39A47EBB1F4512B1057CF4264C99A2F573E2AE3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\_hashlib.pyd
- Size 71KB
- SHA256 3cfb95355576805d6362b878d2207e254125887fce12ff8199becab34beb0694
- MD5 df64fd4ff2ef2dbf7d64f510566d8e6c
- SHA1 d17fdfc119006d41ded0ae7defa2bbaa7720e17f
- SHA512 0d8f818d9eec55780ae6642a794807d837183c9878fa8d2bae39c8a8e31020202d21d5fabd381d5937679dd4199c1afab53c427148c650717a289d7d73536fc3
- SSDEEP 1536:CY2ILIsV3FkBPfYXToBBPEuSoYIVDI9yyPi9BfIeYKO:tIXso3P9YIVDIZPz
- TLSH T1FF636C56A2480091E9A381B4C9A70F87F936F6612700A7DF53A8C1CD2F637DBA37B754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\_queue.pyd
- Size 35KB
- SHA256 00206e5ea1be8b648ca07d1e68ee244a8d0ee1f4126661187dbe3551c68f6e3b
- MD5 569207673d8f86983b4ff51cee6b8450
- SHA1 1427709eb49f48786b246708bda0fd34e9595296
- SHA512 cf81a17875d2e09615ce620d37cee75201b4741338428b9c4d32186861e59c7ed616ca77864732043a464c0976e3d9ac3a820bc327714e16a8c2491ca253aa0b
- SSDEEP 768:UdWTUTYDeLO5Pyt0U5+ShcIVRUa/yy8PuBL2Ip41Txf1mlLbk9wf:U83DeLh0U5bcIVRUa/yyPi9PfIE96
- TLSH T1E4F28DC7A75800E7F6778671C2F6CE56F879F793571182DB20A8814D2E237C2673A628
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\_socket.pyd
- Size 86KB
- SHA256 ba52c110c0cbc429add306acccf86dd2f77c777a9db68df7cddfc4489e91bce7
- MD5 b171ad631cd703741a1859288aab2f3f
- SHA1 7d32819af22fccebce7babddfca08a4989cab7a5
- SHA512 c6537734d00eed08054b5fa7688df9b456306938b6feae36cc9add1f1d890d309b18589992dc134217bf13b0e12661bf2d91ef941aae819367f4fb2056bab4c1
- SSDEEP 1536:xnFMxLcWYyu9To2mT6ypYTiXA+6Xwwz41NABy4GcEXcIVGw5iyyPi9rfIeY4BO:3e1fu9XmGypYTiXAzXwwzkAs4XEXcIVo
- TLSH T1C1836A41A66050F6EB72D175C2638E63FF74B5C01394A7DF1466C69A1F333C2AE3AA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\_tkinter.pyd
- Size 69KB
- SHA256 3b4e3ba215fef3521fc72293afe52aa209e981c32e55ee94427032dcaecc26b7
- MD5 de76f29ba08ed072f1e807b7542eae7e
- SHA1 6e31bd917fe991d51327f0968cd0a48bcd0fd6ce
- SHA512 c7dddd60672b1f482aca8392931dabd77ddb79a6bb62fa2440b0856940f0782983c56d194c28023e15ba3606ad2ce6ac688a7f44ff92f6df99e21466655348b5
- SSDEEP 1536:ThyLLAFP5ujO0C6sURMFW233o4WGcL2YIVDSvyyPi9hfIeYrm:TYLqPUg6sb9I4WGcL2YIVDSDPC
- TLSH T134636C4A6364009AEE62957CC9725F53F675F5524B2082DF01E0D29A2F233F3A7BA714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\afk_client.dll
- Size 13.2MB
- SHA256 b961c177dfab55c8dbb9e7f3d696603ab115cb27f4bed59078dfc8e44aa4205d
- MD5 6395072d751824c996bd0d8557b4acae
- SHA1 6ea8a618da2fe102f9c6e012bef0e3d2a2f0f2b9
- SHA512 7b3d20b54066f49ee157a940255dced94538dee6f44d8f843f4aa7e38adc57ae412140af96881f54f2debdbb9f794f8f6870423ae03ce7dd1c6cc5c54543a6b3
- SSDEEP 98304:pR8m1tXCG3UzRXAYdsKIfiX6fpHfvcJuHTxanEqq3MvWvC4pYVtysNLY838Ws83W:IPy1TjyvjQKwq+/
- TLSH T152D65C9B21616053FE94F0B95F17CDA56B31B06BE300B6A7F88898783F529523FBC158
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\libcrypto-3.dll
- Size 5.7MB
- SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
- MD5 b306c000f2b892736f0e66d265c61876
- SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
- SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
- SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
- TLSH T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\libtommath.dll
- Size 79KB
- SHA256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
- MD5 d905551350a3d711a5e72a284a07997b
- SHA1 4eb1261e90e19d241893e486aba6747a74d8b97f
- SHA512 35c92d493efe9a2296ba94a4e6851132ad826dfc749bce3fa9bdc9352855aae9bc57521e79ce7f49cfbf486bc15d5c767ed50ee70d966d568d639176350b689d
- SSDEEP 1536:03RaimSoWEBrh2as3iwaOasKuWoSvMD9NN:KqWEBkL3iwvrD9NN
- TLSH T184833907F6C620FEC05AD1B6C70A5322A6A2B8239B267BDF23016E255D55FD06F3F251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\psutil\_psutil_windows.pyd
- Size 69KB
- SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
- MD5 0a66d22d2ac4f9d41e1605b8d05de77b
- SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
- SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
- SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
- TLSH T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\python3.dll
- Size 74KB
- SHA256 e394c32bb9e2f0d813f4ed5b858ba717e54e3e6547cd36a8d8aaee66b9ca347f
- MD5 2213f9ae352fa0f65498557764c34396
- SHA1 2d547d9625fadde3f56b3e3bcdc5e47f4bd6c962
- SHA512 1526bd1967407e99dcf19c06f2cf95a8576af2f844afea8f3380a741d0a244a5638271d643ef1c4d07b2616bd82bf99915744a292b877f081f784230d0fc8fa7
- SSDEEP 1536:I2+7QHQnnBjKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/89PC:MQYcIVG0ePl
- TLSH T115732C525B54F8E2DAB667FC7893998D1F2B12CC83298C9C647D93C20DDA313A62734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\python315.dll
- Size 7.5MB
- SHA256 9862572fd449f32a62c1eaec2c6750a9c9fa512f4c9c2ea0e66776cf9212b7c2
- MD5 395c0d80187270f59080308ee40003c8
- SHA1 7e805504a978d7df5b97ced9afc20cb50f538d0c
- SHA512 bda4de803e84983825a47a2a90b0a60cd8077da5223d45ddf512c772101db54ddc08a7ac0848408f4763333fc60da8d6c97690a2e1d979a1a23c05f1930f1b56
- SSDEEP 98304:I1bIGojkI/VMBlEup2/bSnpBU7zA5EAJ80XvQHDMiEtudVAgzTwe:I1bIt/VMBaup2qo7zA5dJjipfwe
- TLSH T1E1867B7AB2A901A4DC778035C5434647EBB1BC10BB20D6CB52547A9A2F333E35BFA725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\tcl90.dll
- Size 3.2MB
- SHA256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
- MD5 9bba592e4cf79745bad7d5ea9fd3c347
- SHA1 b9c21bde58be54333529c49d91c6a419e55abc6c
- SHA512 cb3f99cf47e7fa9a1bc124d5ee1b061bf3f13d9afd575a49040d3d4f03775b702d8a2e08b33e4ecfebceeebe334958b89d7ad0e6378f37768b142adebe4d0d75
- SSDEEP 49152:JLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugz:NWrPOVNFFvsJnNKfXAqRGYYM
- TLSH T1F2F5AE46EBA40068D5B7C27CC61ACD5BDFB274581364AADB14E05B612F73FD2237A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\tcl9tk90.dll
- Size 2.0MB
- SHA256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
- MD5 f07870b32f577cf36256def49d360787
- SHA1 c6311ef53589dc7937b4b2cf70782a785ab00f92
- SHA512 0e2ba98202d3610601298bde13de16dbc80d894c5b3d6f415f7d477b676d317eaa706d005b84e4884e1811dfb2366dec080857853f7fb52ad0e1244efa04c467
- SSDEEP 49152:q/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6y:os7+8JToVH+MQ
- TLSH T11FA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\vcruntime140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3228_358127_JeMXAFZZO4I\zlib1.dll
- Size 100KB
- SHA256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
- MD5 1377669a18e22b364fb390504e49260a
- SHA1 e42eb7900b11f952ce0cd808fb6e1662fe25c373
- SHA512 80538f4c1a64d3b8b0329610c44a2c61d696f4e880a61b935047e2291edcea29ab4bbb0c0a9af9247051690823d7699728ebb4474ac1639317af0c70e830f124
- SSDEEP 1536:zeKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fB:aNGH+X34najvon8PVh2FXws+Z
- TLSH T195A37D47799620ADC1BBC231D6E61B21E6B638400B2D1BE74284E7752F02FD06F797E9
- MD5 SHA1 SHA512 SSDEEP TLSH