Overview

overview

8

Static

static

3

تلغيم...ا.exe

windows10-2004-x64

7

تلغيم...ا.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    901s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/11/2026, 22:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    تلغيمه غير اسمها.exe
  • Size 21.7MB
  • Sample261107-2prlnafy91
  • SHA256 6dd819fec3ed5b282b4df8f14c7c608a05c1c39d3fa7975597e48e47d102ce56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes a file named after a Windows system binary 1 TTPs 1 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 39 IoCs
  • Modifies system executable filetype association 2 TTPs 47 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 22 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe
    "C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe
      "C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe"
      2⤵
      • Executes a file named after a Windows system binary
      • Loads dropped DLL
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3332
      • C:\Users\Admin\AppData\Local\Temp\sys_2875.exe
        C:\Users\Admin\AppData\Local\Temp\sys_2875.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3832
          • C:\Windows\system32\reg.exe
            reg delete HKCR /f
            5⤵
            • Modifies system executable filetype association
            • Modifies registry class
            PID:4956
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x33c 0x3bc
    1⤵
      PID:3764

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Change Default File Association

          1
          T1546.001

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Change Default File Association

          1
          T1546.001

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Masquerading

          1
          T1036

          Match Legitimate Name or Location

          1
          T1036.005

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Network Configuration Discovery

          2
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\VCRUNTIME140.dll
          • Size 174KB
          • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_asyncio.pyd
          • Size 76KB
          • SHA256 fb0768cc8b00cee43638bea2770cae08f2076298ec3db07634818448b6ad67c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_bz2.pyd
          • Size 84KB
          • SHA256 2ae45b2ff932dc8a864c862d8150eb3f5b55e60e3e74ec554c4f52c4f1ad81e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_ctypes.pyd
          • Size 140KB
          • SHA256 8bb22628ae859877b1cf55381c1a8cf54bb0aa70c56295053bc3303262e21c87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_decimal.pyd
          • Size 318KB
          • SHA256 93360ba1650bf5f1a673aac22d444ad2d33a039550926f325ad19dafd950e04c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_elementtree.pyd
          • Size 142KB
          • SHA256 7176037f79c25da745403e0f9db184f0d2046eef84ce976c790ff684a202e610
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_hashlib.pyd
          • Size 71KB
          • SHA256 3cfb95355576805d6362b878d2207e254125887fce12ff8199becab34beb0694
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_lzma.pyd
          • Size 167KB
          • SHA256 d9033e94387aa70777d23514263d342486899256ffc14478be6bb1e6a0b05683
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_multiprocessing.pyd
          • Size 37KB
          • SHA256 df1c1a1226a481db6536b6ed697150bc6a34052e4c2cc2ddde59ebda84a68fd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_overlapped.pyd
          • Size 56KB
          • SHA256 077d6a9ce8a3d379a06d78ac4be2efcf35006fff6cd5be4cd5f574d83e7a9c01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_queue.pyd
          • Size 35KB
          • SHA256 00206e5ea1be8b648ca07d1e68ee244a8d0ee1f4126661187dbe3551c68f6e3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_socket.pyd
          • Size 86KB
          • SHA256 ba52c110c0cbc429add306acccf86dd2f77c777a9db68df7cddfc4489e91bce7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_sqlite3.pyd
          • Size 129KB
          • SHA256 851e8bfa65328162ddad2dff9f7c213f8eceb2d90baf179aa472704ec3ca6295
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_ssl.pyd
          • Size 195KB
          • SHA256 a9c54ec4d115597880e0e44ff26b740328d0388a777dfb613d3aa2eb66b31e49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_uuid.pyd
          • Size 27KB
          • SHA256 a3380826957922fae7350f5ea64fface688bf55c79e086823a4b1d50455a9bfa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_wmi.pyd
          • Size 38KB
          • SHA256 0650bf237b3f556ba844ba372fef6de1b65d618a608014405360aef83f8a4e34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zstd.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\_zstd.pyd
          • Size 494KB
          • SHA256 a977471edf7b6712a9e89ada98b79b1973c79740632f820b67365f242b5e05cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_parser.cp315-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\aiohttp\_http_parser.cp315-win_amd64.pyd
          • Size 302KB
          • SHA256 de8d12b3bdbded5f7cda7a1616d93bdf4ad151abfe5276e03ac2322601f2eb3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_writer.cp315-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\aiohttp\_http_writer.cp315-win_amd64.pyd
          • Size 43KB
          • SHA256 4797c4dfc14423d4dcdcbde19692d8ed1744a68207b3c5a98e3b1625186037a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mask.cp315-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\aiohttp\_websocket\mask.cp315-win_amd64.pyd
          • Size 34KB
          • SHA256 ad05013c58a9d1b73cb29ce9999ba01d47eafa2e2c66bb52516f7ce0344aadb7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\base_library.zip
          • Size 1.4MB
          • SHA256 1b83d18175295017f9c43ac80de10de8370de520e84d9d411709453c303f8e1a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\libcrypto-3.dll
          • Size 5.7MB
          • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\libssl-3.dll
          • Size 1.2MB
          • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp315-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\multidict\_multidict.cp315-win_amd64.pyd
          • Size 127KB
          • SHA256 3ecd6c9ec6c331a9bcab9bad8b20d6e1453986bff7521fc1cb0923f3cc97bf1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _helpers_c.cp315-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\propcache\_helpers_c.cp315-win_amd64.pyd
          • Size 65KB
          • SHA256 2ac2fbf7fc98263fcd914bc27c38548fe5b2dd301bb7c6f9e1a3dc7a5f8b77d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\pyexpat.pyd
          • Size 210KB
          • SHA256 2970cef7642e14721b4791bf40720d25f5c9fb8df4d78c725bd859391d6dec51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\python3.dll
          • Size 74KB
          • SHA256 e394c32bb9e2f0d813f4ed5b858ba717e54e3e6547cd36a8d8aaee66b9ca347f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python315.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\python315.dll
          • Size 7.5MB
          • SHA256 9862572fd449f32a62c1eaec2c6750a9c9fa512f4c9c2ea0e66776cf9212b7c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\select.pyd
          • Size 32KB
          • SHA256 d39e00967809d2d2cf8aea78f6fd39923cfb4ad426ccd19bbfe7163020dafffe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\sqlite3.dll
          • Size 1.6MB
          • SHA256 73530e8f4555605d716352ee98fe0ce205a09e5eec57e7e6360d4c915efcacd8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\unicodedata.pyd
          • Size 735KB
          • SHA256 ba69f643918cc520331c6a13d489d642131be23dd649d05e0cd1068fae92e76d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp315-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000010482\yarl\_quoting_c.cp315-win_amd64.pyd
          • Size 80KB
          • SHA256 c0570d089c699300d1c43fed7f6d346ade4d20a1028243578d1baa1a4bf7dc67
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4452-121-0x0000000000560000-0x000000000056A000-memory.dmp
          Download

          memory/4452-122-0x0000000002810000-0x0000000002820000-memory.dmp
          Download

          memory/4452-126-0x0000000002810000-0x0000000002820000-memory.dmp
          Download