Overview

overview

7

Static

static

3

1fab74a64b...c8.exe

windows10-2004-x64

7

1fab74a64b...c8.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 17:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8.exe
  • Size 11.6MB
  • Sample261102-v1wanaxy7r
  • SHA256 1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 29 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8.exe
    "C:\Users\Admin\AppData\Local\Temp\1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8.exe
      "C:\Users\Admin\AppData\Local\Temp\1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1236
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5804

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\PIL\_imaging.cp38-win32.pyd
        • Size 2.0MB
        • SHA256 b52e1cee3cd203cd9ad9731c9664cf916aef47694859adef39c5dbde84077336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\VCRUNTIME140.dll
        • Size 74KB
        • SHA256 9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_asyncio.pyd
        • Size 56KB
        • SHA256 89b48a77be8fa5b1614152f79c85b56bc26f026b0491749908cdf2186407b06f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_bz2.pyd
        • Size 77KB
        • SHA256 82a85187faf8786216c82ac1c4ccf32c8839048e242025ed4e7a1e3ab870255f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_ctypes.pyd
        • Size 114KB
        • SHA256 3a94a3525b0531524aabc7f8fc9f1253894cd612a9823d9cdd5070ab81b9d329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_hashlib.pyd
        • Size 38KB
        • SHA256 8929b5818aaa0f595b8cc3b6aaddc630f2b27bcde3a29d44c13d95037596aa1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_lzma.pyd
        • Size 155KB
        • SHA256 d3350ad957d6c37b2c75f56a5a149f0eeb58295227f78c15048669a2e816ae3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_overlapped.pyd
        • Size 38KB
        • SHA256 d0e3998106623fd5197a4fb274e91243823c16a8fbba1b42dbccb4bcabd9f074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_queue.pyd
        • Size 25KB
        • SHA256 e8d293cf77b9f94395c18a26ce38cc1ca01a183db3e9105ed9040338ea252ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_socket.pyd
        • Size 68KB
        • SHA256 48f1f1842e6845a197c9be50027bb2a67a868e743bfa81b8d8753c24cdc08b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_ssl.pyd
        • Size 140KB
        • SHA256 5dc85dd0bee9ef96c1f278398cc7af36de2f3721dce726a4b13d64bd63eabc39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\_tkinter.pyd
        • Size 60KB
        • SHA256 8ac8e3fcec7d6a9bd1e1bb915cac4570b28563912ccd3c998579be0a3b1f5897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\aiohttp\_helpers.cp38-win32.pyd
        • Size 43KB
        • SHA256 b84e399b32b1c18f58ad38c6184b2ac99d6abefe411bfef41797c1a03d5362f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\aiohttp\_http_parser.cp38-win32.pyd
        • Size 237KB
        • SHA256 9728bbd0dd84d287b305661d37c9b45a0bdd817561de48d0b8ecdba42a5fb6e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\aiohttp\_http_writer.cp38-win32.pyd
        • Size 40KB
        • SHA256 60722f08f7da917dc4741ec6f295d9317899f073e1f8c29c47305e644b9086b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _websocket.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\aiohttp\_websocket.cp38-win32.pyd
        • Size 30KB
        • SHA256 c5cda310f854d2d3bdd9e817e475b2430e0119c36399a3222afb8d7d3b88ace4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\base_library.zip
        • Size 855KB
        • SHA256 b979e078ade78090eb8928dfcf36ed6790017f2cce6906abcaf0cb60beead61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _frozenlist.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\frozenlist\_frozenlist.cp38-win32.pyd
        • Size 71KB
        • SHA256 d058d44061bd1e118f72ff2d64867dfe26b9f81a0c4cffdb8e9df88931a182ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\libcrypto-1_1.dll
        • Size 2.1MB
        • SHA256 1e95a63b165672accde92a9c9f8b9052c8f6357344f1376af9f916aeeb306da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\libffi-7.dll
        • Size 28KB
        • SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\libssl-1_1.dll
        • Size 526KB
        • SHA256 06958c63049e2d7fe1f56df3767e884023a76bba1f41319f7fab3439b28174c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\multidict\_multidict.cp38-win32.pyd
        • Size 35KB
        • SHA256 d868eb599ab26577eb17dc403bff3651c469ea2e1b820ce120d8fc9971ee5928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\propcache\_helpers_c.cp38-win32.pyd
        • Size 62KB
        • SHA256 728ec4af35a6c58dc67b6f5201c0c217f6a8519e3e26d9cd70cf4ca2c134108b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\python38.dll
        • Size 3.9MB
        • SHA256 a9675a91d767095c9d4a2ae1df6e17bdb59102dbd2b4504c3493b0bcbed5ef55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\select.pyd
        • Size 24KB
        • SHA256 6d5a3630570035555cea342c3a8e2922ca23451113cb178cd7fee07e59da123c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tcl86t.dll
        • Size 1.3MB
        • SHA256 e79443e9413ba9a4442ca7db8ee91a920e61ac2fb55be10a6ab9a9c81f646dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tcl\auto.tcl
        • Size 20KB
        • SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tcl\init.tcl
        • Size 23KB
        • SHA256 bc492b19308bc011cfcd321f1e6e65e6239d4eeb620cc02f7e9bf89002511d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tcl\tclIndex
        • Size 5KB
        • SHA256 abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tk86t.dll
        • Size 1.1MB
        • SHA256 19f70dc79994e46d3e1ef6be352f5933866de5736d761faa8839204136916b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\tk\tk.tcl
        • Size 22KB
        • SHA256 e1067a0668debb2d8e8ec3b7bc1aec3723627649832b20333f9369f28e4dfdbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\ucrtbase.dll
        • Size 1.1MB
        • SHA256 e4f8f92eef00ff6a0c6d418af756a59d5a4b818d0d1de0d96cc193b4d6759432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\unicodedata.pyd
        • Size 1.0MB
        • SHA256 af602c6033875478b8cec6270c4b0fa618290b97c7e139d71dbb58b83a08781a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp38-win32.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43522\yarl\_quoting_c.cp38-win32.pyd
        • Size 81KB
        • SHA256 2696d1dd3eccc19ed4dbe01674a08474d5a9698d9695009ff168ab6026e00f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download