Analysis
- user interaction
yes - max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 14:41
Behavioral task
behavioral1
Sample
ransomware_with_key.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ransomware_with_key.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target ransomware_with_key.exe
- Size 11.4MB
- Sample261102-r2p89acz2p
- SHA256 5da630faad80a8b85c146403de723fb9009fe8a1aef4fb149221376cfb902b52
- MD5 fa0835c102b26efc63e298bab24b8013
- SHA1 7597209820f2f28fbf219eb2c7729730fe92a236
- SHA512 b22768b2a471801699492ac6faa527304aa955cd2b496a9514aa615ad3a50bd3a9bdcf9530ec05949290940d5098efe670e74473fba69d890b7fe6773aa79f0d
- SSDEEP 196608:WSAY3emwpvcFA3bL6XMCHGLLc54i1wN+kokSaPA8hy7rKndoo7VcXK+:1AGa0FAbL6XMCHWUjsodaI8hy7rKd9gn
- TLSH T159C63315722106BFF8F7813D86E5CB35EBA67C461B26CA9357E566223E030D01D3CBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
pid Process 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe 4836 ransomware_with_key.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2828 wrote to memory of 4836 2828 ransomware_with_key.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomware_with_key.exe"C:\Users\Admin\AppData\Local\Temp\ransomware_with_key.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\ransomware_with_key.exe"C:\Users\Admin\AppData\Local\Temp\ransomware_with_key.exe"2⤵
- Loads dropped DLL
PID:4836
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_bz2.pyd
- Size 82KB
- SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
- MD5 fe499b0a9f7f361fa705e7c81e1011fa
- SHA1 cc1c98754c6dab53f5831b05b4df6635ad3f856d
- SHA512 60520c5eb5ccc72ae2a4c0f06c8447d9e9922c5f9f1f195757362fc47651adcc1cdbfef193ae4fec7d7c1a47cf1d9756bd820be996ae145f0fbbbfba327c5742
- SSDEEP 1536:ZWNz7JrA+VLsS53XtGHagwIF27YuLw8emTayR12FIvCVv7Sy+xJ:0Nzdb53XfoxKrbTBkFIvCVv4
- TLSH T161838D53E39566F5F86F80BA5AC10366E731B954075083EFF348C2692F02F826DAC369
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_cffi_backend.cp312-win_amd64.pyd
- Size 177KB
- SHA256 9af5e4f68a41f26b726f2e9424f9d58a4f5666189f6a48be95f406b257102aec
- MD5 507d7acaac822c99f2f574d354af43b0
- SHA1 bbe267010c80e0988937d0cb35852081dcbd3395
- SHA512 a2236f07849144bf6842c3a48f5d816944d5505168b11edf1803ac05140c1de9af8321777e94dac0babbd26a315d902bfe5e297b1ee56c69230c7314c4fb8136
- SSDEEP 3072:knXfJh2GStDfSNvGh+8JYCJ/QXIlv6g6g0h3Vcv2dxQsGsdwofbP7clSTL7Ku3AS:knxvGhD0uv6g6g05Vcv2JGqHfbAlSTLt
- TLSH T19E046C5A329C11B6D5A2517886579B43E3B3B421170197CF01B0C7B62F1BBEA7A7FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_lzma.pyd
- Size 154KB
- SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
- MD5 e3e7e99b3c2ea56065740b69f1a0bc12
- SHA1 79fa083d6e75a18e8b1e81f612acb92d35bb2aea
- SHA512 35cbc30b1ccdc4f5cc9560fc0149373ccd9399eb9297e61d52e6662bb8c56c6a7569d8cfad85aeb057c10558c9352ae086c0467f684fdcf72a137eadf563a909
- SSDEEP 3072:kf7P77jrFDn7NjQDRX17znfV9mNoHnIjN1VbHNiFIvZ1AB:kf7j9OD9YOH+bHNiJ
- TLSH T173F34A96A394F0E5F7628C78D6624F57E7F5B809032092DA01CC876D2B1FB659E2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\base_library.zip
- Size 1.3MB
- SHA256 9b03104a6087e37a5d8a16a73edb0567ac00e29f31250f6706a44a132c458c90
- MD5 4fdae356b6b60bb242ed69d4749a2e17
- SHA1 85edbf54b8fca203407806c6061c4822a78c6777
- SHA512 2ec0b45bff1b142bf97670d232a5b93560d05d7923a90b0b6a919f0725e0158df11e1a11d2f7d43845fe9c04ec58ac0f4e88b11d908081c9a6fe5717bf076a02
- SSDEEP 12288:ZRJ2/Hhs8lJGUq0Trmn9gHbP+dmmV9BN/SquMnVTVihlyixmpvQXMHYRV/REA:Zj2/Ha8lJGUX69ibP+dmoD3HhC2A
- TLSH T13F55D6817A92A5B3FC84F3BA04260A0EA3658571BF44C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\cryptography\hazmat\bindings\_rust.pyd
- Size 9.4MB
- SHA256 1d4332a447cab13dec8e3a533ad579e0e562b79e40822c931f33769758fc7156
- MD5 78a9b43f7635ac4ca6df3192ed430555
- SHA1 dda0656357da9ff20015a9cbc75ecf860113fada
- SHA512 57ebe36035a01bd27c995bef314272ce1fb717a8acbf60e1d4cd121ea452d3b6d19bc17e0039fab74ba02de6917cf4508b38ff10f3cb319a512c6e8e838ae75d
- SSDEEP 98304:EYpGu1vtnEnZ9hVAGrqf5ONee5Dlr44o3lxhN9t5M+C2Cx:UNee5Dlr44o37Vt2Nf
- TLSH T129A65B29BAA950A9D86AC4B4C34756339B3134DA1B347AFF49D096B92F36FF0163D304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\python3.DLL
- Size 66KB
- SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
- MD5 2e2bb725b92a3d30b1e42cc43275bb7b
- SHA1 83af34fb6bbb3e24ff309e3ebc637dd3875592a5
- SHA512 e4a500287f7888b1935df40fd0d0f303b82cbcf0d5621592805f3bb507e8ee8de6b51ba2612500838d653566fad18a04f76322c3ab405ce2fdbbefb5ab89069e
- SSDEEP 768:XV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/c:XDmF61JFn+/Oi5IvL0b7Sykxr
- TLSH T155637052BB54F8A3DBFA69FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\python312.dll
- Size 6.6MB
- SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
- MD5 b243d61f4248909bc721674d70a633de
- SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
- SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb
- SSDEEP 49152:YeceS1L2qpQvgBciWdyVahNTjy8VtvUt1wX/n8gRymPMVTBl2XhXNtMH2lt6cSA/:+RzBHWwuVGij3vwHDMiEHtSzW
- TLSH T1BE666C567358C0A9C96B90B4CC13C68EE7B27C517F60930B70ABB71E2F73792969A344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\ucrtbase.dll
- Size 1.3MB
- SHA256 d404dc9aa843d53d7e276dd078b2cac8d7aa905e2838a1fe8385278e19ba3810
- MD5 1c5c8447d570e0eceefc9f3f92c008da
- SHA1 a198c2897e6a1c5745e2ef7f508541dc21675ad4
- SHA512 a1dd080b57a6339cbc66c9abaecc0a59315b9dfe843176267b10a8324b8eb15e0f2c856c7de938d3405905dadc36d75f0ad3ad67d8aff5caa42ceda889c07607
- SSDEEP 24576:XUanuON+jflUtGz/rLeX+NNF7R8b1h9X2kwlNsmGb6mxvSZX0ypympKF:EIuON+jfl+Gz/rLeXDdXGQepo
- TLSH T16055AE6676AD01E9C1BFD138C65B4506E9B2781503708BDB03E94E7A2E3BBE5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH