Analysis
- user interaction
yes - max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 19:10
Behavioral task
behavioral1
Sample
SORROW.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
SORROW.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target SORROW.exe
- Size 13.0MB
- Sample261104-xvs98ae16l
- SHA256 87676c245fbc3a47594300c81c5822a36feaf1c551b40958584b48889fc142c8
- MD5 7991830feb66fa811a32f59d79b4668e
- SHA1 8d50f686c450634a4117c05605a22db1e9744afb
- SHA512 cf176b315f6eeb0e78c5d03e224f7d6bc26fb414f2e51a090a492ee69ef32e1c51fb7d91d3f8d2cd93d4c939882a4a3ff6273188149b4d440c86dfc9c35e584a
- SSDEEP 393216:WyjPZE34JaunGmIFFXySoiHVBSC7VzC2OyKvz:3+OmvgziHVB/Zz/OLvz
- TLSH T122D63394D69052F6E877A43D58F3E012C5A3B6154772DAEB07840B682F372E18E3DBB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 26 IoCs
pid Process 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 5968 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe 2788 SORROW.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4160 wrote to memory of 5968 4160 SORROW.exe 91 PID 5968 wrote to memory of 2788 5968 SORROW.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SORROW.exe"C:\Users\Admin\AppData\Local\Temp\SORROW.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\SORROW.exe"C:\Users\Admin\AppData\Local\Temp\SORROW.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\SORROW.exeC:\Users\Admin\AppData\Local\Temp\SORROW.exe --loop3⤵
- Loads dropped DLL
PID:2788
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\_bz2.pyd
- Size 85KB
- SHA256 b02f580daa0b390b2228d2a8186ef119be658c89cc64d0bd909550786ed993f2
- MD5 2301264d99e1f699ad99277198e33f60
- SHA1 3b5faaf13c5d41f7bf0cfa3133b109a275c71a1e
- SHA512 9521c78475bb769ae7da6c32b65076524868606c1540c88d76751e3b9d7d85abb176944fb556ceb336c71c8c38f3f3d240fdf46d0102fe7d82ca3cdd0a78db36
- SSDEEP 1536:u+BDlz7WQBcArn6vyZuZOpkVHMf1k8RUbozkIE3Vlyb2QS9+fIYa+:fBDlz0AOuoOpkWf13RYozkIE3VAAm
- TLSH T1E9838F92E36462F6F6AB81B4D2910753F731BB96031063AFB344C2853F12B91AF59365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\_ctypes.pyd
- Size 139KB
- SHA256 b96680c6bcad9e9403711ec0977866325e8e5aab93b56e83c3df6280ae72a82a
- MD5 b64caccfbeec4b33e9382f0a7a4a1ce2
- SHA1 e4083b66fef087c3367b685b69b631d69efd7a61
- SHA512 459d28bb3b02e00af5c7dd1e1425ec54bce426e3e791b15373fd2f1c116e800ef8c42808fd87ffac401be3e96f4f2ec1db10e1aca1672bcdd22d229d31511611
- SSDEEP 3072:pW01NUax09Hq0SG1OgI4pSJQoJ+aQIEGPtsC:0YNUGQSpgI4MSPaV
- TLSH T121E38F4B336840AADA678138C5739E47EBF1F4526A50938F41A4C99B2F533A26F3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\_lzma.pyd
- Size 157KB
- SHA256 9099ef451fe61d8feef9e02894902b88fdc8ee404e3f8b7412b150878c973803
- MD5 d74403a7a01d1081e1ada23bc68ea73d
- SHA1 8928cc6ddad888e8f793606bcf87880195b3740a
- SHA512 d238626870c290d690357e50c1d3d3fa99830caf9d95b9dbbd33c74b54c90108b7611733ae4939b9ea9ac95a87a563e04f201312491b84f894a1efbb81e28618
- SSDEEP 3072:AJ66g4T5QW7JfyjEqkSkA51b4DznfJ9mNogUIsbkIEI1FRaT7z:AUR4Tp4QPZ8N4/xYOVb3Uv
- TLSH T170F35C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\_tkinter.pyd
- Size 69KB
- SHA256 36675f9038cc1f1fea08b68ef38c5da94b41efbcd3a421421198f49f01afd8d0
- MD5 0aad7f83068dfe094174eda2a6e81c42
- SHA1 750a7fb9d7c43cc60ed5838c2424f37bbd324e5d
- SHA512 ed290592582597b9f3d615ebb2de322f91128fbfa1d4dbb08da46ba6034d01ba6806fbdf835c3a063c744b4136a37d4839e96d0a7ff5e7c951014eeca7382f33
- SSDEEP 1536:/3rQ5vzPC333f/x6pt33mZgZ0+jsIEDSlyb2QS9HfIkwx:/3slD233szGZgLsIEDSArb
- TLSH T135636D9B5768008AEEA3C139C5725F13E5B5B9625A20934F40A5C39E0F333F3A7BA751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\_zstd.pyd
- Size 491KB
- SHA256 526d977236cc63895902977f216bf3ca93a4233489240656b295eafb6f518d07
- MD5 3dbf9908e2bddd4346be7370bf6a8d87
- SHA1 ba5c0b6770b37943fafbf013bf575aaf461b73de
- SHA512 b87a623ad93fbf77500679f89daad61e9ee316d0fbc1e778d6a37e29f449c30ce108b24fca545a6ea6de8b9568c9fdee7b7f5ae54d51c7e6eb1ad0119f7348bf
- SSDEEP 6144:soRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFEK5+SClP:3RFcemgqKP2eeVC2Lz9kQeK5BCl9VdxX
- TLSH T111B48D43F29943EDE53BC4B8CF465A13FBB1780B1214964B97A5CB993F07B309A69309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\base_library.zip
- Size 1.3MB
- SHA256 2b65cf4782c2398e866fd4203503757dcce08173bd86fa466dafc719b60bf098
- MD5 26f6b08921318eab2042acc79f8cc29a
- SHA1 c1d86d81cf8aa983ba0ed1c904d83a0345d42323
- SHA512 9d5f5aa7fcb2a17bea00b8a874615eb0e4595971d4365f47a33ce13def50f915b0739dbca49a1bbf1b48343ad1fe6d5d752eeb284ce4e168faf70f3b9140d88d
- SSDEEP 24576:fRQeOdP2m2dfyRZKDZAlbBrLpdu/RuUFbYOG:5/6Rg+dcuUFbY1
- TLSH T18F552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\libtommath.dll
- Size 79KB
- SHA256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
- MD5 d905551350a3d711a5e72a284a07997b
- SHA1 4eb1261e90e19d241893e486aba6747a74d8b97f
- SHA512 35c92d493efe9a2296ba94a4e6851132ad826dfc749bce3fa9bdc9352855aae9bc57521e79ce7f49cfbf486bc15d5c767ed50ee70d966d568d639176350b689d
- SSDEEP 1536:03RaimSoWEBrh2as3iwaOasKuWoSvMD9NN:KqWEBkL3iwvrD9NN
- TLSH T184833907F6C620FEC05AD1B6C70A5322A6A2B8239B267BDF23016E255D55FD06F3F251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\python314.dll
- Size 6.5MB
- SHA256 854fe7549eb4b2ac478935a38ae2ca1b774c6fdc3d87f0263fbd697ff86d7149
- MD5 2e80dbbe49a92e731184c0b0893b220e
- SHA1 7aac631c5001ad6b1e6886a82e3c9e14215bd4f4
- SHA512 291c1d8fdc1973a5a439e59d03384a2b31d010cba357d37cf24c4706457b4277d66eac7f162d0208a5a1d255c6f8105c16972be439cb4a7877c90ea057b25f7b
- SSDEEP 98304:UUNfZZoy5opBcWVnrEYVISXP8YamvvxHDMiEAPIr7:UUNfZZo1IunrEEUziBIH
- TLSH T1CF668D66737801A5D9BB8035C9034647DBB1BC10AB30D34B49A4B6DA3F733635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\tcl90.dll
- Size 3.2MB
- SHA256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
- MD5 9bba592e4cf79745bad7d5ea9fd3c347
- SHA1 b9c21bde58be54333529c49d91c6a419e55abc6c
- SHA512 cb3f99cf47e7fa9a1bc124d5ee1b061bf3f13d9afd575a49040d3d4f03775b702d8a2e08b33e4ecfebceeebe334958b89d7ad0e6378f37768b142adebe4d0d75
- SSDEEP 49152:JLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugz:NWrPOVNFFvsJnNKfXAqRGYYM
- TLSH T1F2F5AE46EBA40068D5B7C27CC61ACD5BDFB274581364AADB14E05B612F73FD2237A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\tcl9tk90.dll
- Size 2.0MB
- SHA256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
- MD5 f07870b32f577cf36256def49d360787
- SHA1 c6311ef53589dc7937b4b2cf70782a785ab00f92
- SHA512 0e2ba98202d3610601298bde13de16dbc80d894c5b3d6f415f7d477b676d317eaa706d005b84e4884e1811dfb2366dec080857853f7fb52ad0e1244efa04c467
- SSDEEP 49152:q/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6y:os7+8JToVH+MQ
- TLSH T11FA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010402\zlib1.dll
- Size 100KB
- SHA256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
- MD5 1377669a18e22b364fb390504e49260a
- SHA1 e42eb7900b11f952ce0cd808fb6e1662fe25c373
- SHA512 80538f4c1a64d3b8b0329610c44a2c61d696f4e880a61b935047e2291edcea29ab4bbb0c0a9af9247051690823d7699728ebb4474ac1639317af0c70e830f124
- SSDEEP 1536:zeKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fB:aNGH+X34najvon8PVh2FXws+Z
- TLSH T195A37D47799620ADC1BBC231D6E61B21E6B638400B2D1BE74284E7752F02FD06F797E9
- MD5 SHA1 SHA512 SSDEEP TLSH