Overview

overview

7

Static

static

3

5fc90e6f87...3e.exe

windows10-2004-x64

7

5fc90e6f87...3e.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 15:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5fc90e6f87af6ef5f399b3378fc2aadfd591490517ef84e6de80be7605759e3e.exe
  • Size 5.3MB
  • Sample261102-sxt73sfe44
  • SHA256 5fc90e6f87af6ef5f399b3378fc2aadfd591490517ef84e6de80be7605759e3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fc90e6f87af6ef5f399b3378fc2aadfd591490517ef84e6de80be7605759e3e.exe
    "C:\Users\Admin\AppData\Local\Temp\5fc90e6f87af6ef5f399b3378fc2aadfd591490517ef84e6de80be7605759e3e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5948
    • C:\Users\Admin\AppData\Local\Temp\5fc90e6f87af6ef5f399b3378fc2aadfd591490517ef84e6de80be7605759e3e.exe
      "C:\Users\Admin\AppData\Local\Temp\5fc90e6f87af6ef5f399b3378fc2aadfd591490517ef84e6de80be7605759e3e.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5604
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "IMAGENAME eq ruffle.exe" /NH /FO CSV
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5796

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\VCRUNTIME140.dll
        • Size 99KB
        • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_bz2.pyd
        • Size 84KB
        • SHA256 0563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_ctypes.pyd
        • Size 123KB
        • SHA256 2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_hashlib.pyd
        • Size 45KB
        • SHA256 f9548e3b71764ac99efb988e4daac249e300eb629c58d2a341b753299180c679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_lzma.pyd
        • Size 158KB
        • SHA256 5ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_socket.pyd
        • Size 77KB
        • SHA256 1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_ssl.pyd
        • Size 150KB
        • SHA256 8a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\base_library.zip
        • Size 1006KB
        • SHA256 2c1fc53e056c42af347fdf49a15ab56e2507058c0e6568f8ff3b8880adaf3530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libssl-1_1.dll
        • Size 673KB
        • SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\python38.dll
        • Size 4.0MB
        • SHA256 13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\select.pyd
        • Size 26KB
        • SHA256 940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        starter.log
        • Path C:\Users\Admin\AppData\Local\Temp\logs\starter.log
        • Size 121B
        • SHA256 7d98eb25fe5010a014aa75152b4947d564adfce571a21bacfcee96c73912a7c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        starter.log
        • Path C:\Users\Admin\AppData\Local\Temp\logs\starter.log
        • Size 233B
        • SHA256 e784232cfd172e396b255ca538dc8e6cb9e21253ecbdc73acfdab120238d50e9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5604-56-0x0000026809170000-0x00000268094B6000-memory.dmp
        Download