Analysis
- user interaction
yes - max time kernel
6s - max time network
6s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 17:17
Behavioral task
behavioral1
Sample
InstallatorAntyKrzaków.exe
Resource
win10v2004-20260911-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
InstallatorAntyKrzaków.exe
Resource
win11ltsc2024-20260911-en
15 signatures
900 seconds
General
- Target InstallatorAntyKrzaków.exe
- Size 11.8MB
- Sample261107-vtx6nsfd79
- SHA256 d00e2625e596fe3980f2487c8299a0ab5cd3a2e5d9e661f2ed8db31d58b012c1
- MD5 fc23f48c8ada751443a0b01406e301c8
- SHA1 453617dfb70023d05f653d35a54723756c76834d
- SHA512 75e3e1bfedf4fe3e271edc2ff01718661a68690260f10a32c4ad42d5f4cd6d014261c1a0d8b69e991225ab5e4f691aba5698da5f1ac4a56cf95af0467b367b58
- SSDEEP 196608:++INWZBjXEpXnH2ph1igtoxSiLCw10+u41ZPcUQ+jlJg4MtAy9bW6q71tytvonYv:DINcXEAphJta510MjRnpASnytvUYD
- TLSH T1F5C63358F75010F6F8F7803D89D29C12E6E2B61A0B9692DB23B016653F676F06E3CB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe 2908 InstallatorAntyKrzaków.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2908 2248 InstallatorAntyKrzaków.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe"C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe"C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe"2⤵
- Loads dropped DLL
PID:2908
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_bz2.pyd
- Size 86KB
- SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
- MD5 4cc74cced07914bd71dc9c4d2a3f127a
- SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
- SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
- SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
- TLSH T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_decimal.pyd
- Size 284KB
- SHA256 bc3a61685825ae37a4cd2b2b87fa27af12e01575c4f920788ea806e6781a2c79
- MD5 c75e9f59ed7df7cc913dc966c8caea2e
- SHA1 7b3a83474270b5fecea3c4f9864cf3cf056da695
- SHA512 284e0acf04cee094dc953c88d8311ab69b8ea25a844077e70d3a5d9e8531dc69ef0313ee8c2e82af6e7785dd266f565cc21306d5dac36be188c8d1be01365b5c
- SSDEEP 6144:PgR0o97cPAEIiIKG5iGqqM43fIWeA5euMt7uq/X:PgR0o97cPdIiI7NO/b/X
- TLSH T1C4547D56A3490CA4EF738074CA479A57F7B2B8414360D78F43A48AA72F933A3677E744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_hashlib.pyd
- Size 67KB
- SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
- MD5 3fbad145af85337e0c05dbc5ae6c0b4c
- SHA1 fff5ebc3b2f044fbf024605f02a37554fded3b17
- SHA512 aeaf32f2c73da687bb847bb89daf80119d5f2927b439330cb92158180b2fb48013be449228ff40d0be5833cfba3b599265cf9ee84b066f6bff9443bb9005bd65
- SSDEEP 1536:OXwAzOYBQc17JKRQ+C5cIpDILyPs5i9nfIbHHnM:AJ/tJKRQ+IcIpDIJTs
- TLSH T11C635A86A6984092DA2382B5C9E34F43F974F2522B0197DF6678C18E2F233C3577B756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_lzma.pyd
- Size 157KB
- SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
- MD5 e882005d06af06ef17b2338342b3f41e
- SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
- SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
- SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
- TLSH T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_socket.pyd
- Size 85KB
- SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
- MD5 8e833fd16c777682dd1bb099d06390d9
- SHA1 3f455b62cd6bae8f74266d371959298d70412016
- SHA512 1e7d20c0ff2964f718e8387b9a74df0dd89569e2b5a817503a85e3828ddfd29d90bd6bccd7021ef574467ed72dcb8d957d13bb3039ce44ad5a06f17142643866
- SSDEEP 1536:2cVuncT0XH3XAJtZypxQ7XP+66wSzj/jAjI/Lb6UaQecs8PgMrAIpGwfyPs5i9zs:vEny2+jypxQ7XPz6wSzj/jAjQLaQnsV2
- TLSH T1E3835B01A66040FAEB72C172C2639E63FBB4B5C012D4A75F1466D55A1F333D2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_ssl.pyd
- Size 186KB
- SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
- MD5 35cadc41cfff6464baf8d07c87daf4ec
- SHA1 c497ccd0d26491530eb91bd4c671d74a4fcc936b
- SHA512 3d714563a2b5cf20f7cab6f9095dfaf845cdbafc0ddd29332005a9a20136e3602c6bcc0f3eb36945afe60327acf7351168168f6e15f875ee083e63edf33ed0e6
- SSDEEP 3072:MVpZeIk2MZ7IifjvQtY7qr66Xrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrUIe:2xk2MZZjvQttX4457qTVMr6
- TLSH T139147C47B5442AF7DC02E8BAC6234543FBB4F045731197DE48D6EA620F03746AE6A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_tkinter.pyd
- Size 69KB
- SHA256 ee3eb2cdac591821cf71cda8035a6bc9b148d92996dd45b24e3ae3715613315d
- MD5 3fa21737ba104b04ad3cc69d96885d47
- SHA1 06eb875339b8f1bb6f1d1fa429d4374ed1a5d210
- SHA512 b7a30ed377247ac32c84253b2f46052c0177e5d5e7c9156a5c89d8ebd02a6e1967bb3b73a76dfe44e7ebe7c307eedbc64cd108f6875fc552f575b7adeb2a6f83
- SSDEEP 1536:a3rQ5jzPC333f/x6pY33mZgZ0+jcIpDSJyPs5i9ENfIbHfnUn:a3sJD233syGZgLcIpDSNOTw
- TLSH T120636D9B6764008AFDA3D139C6729F53E5B5F9521A20824F40A4C39A0F373F3A7BA751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\_zstd.pyd
- Size 491KB
- SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
- MD5 fee9e34fa16e0ff378c281202a78d003
- SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
- SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
- SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
- TLSH T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\base_library.zip
- Size 1.3MB
- SHA256 7318b24c8e944c627d8679039de8480584029eb5abc0f2fcffd967493db5e12e
- MD5 6de913c34b61560d57056e0fb9196294
- SHA1 28a4d1ffcfba032d22c8ea89c7e7b54776933c07
- SHA512 1ff95eb7ada4d6dabe4842901fa8e4eb9de39e09296052d86bded70cdb77c0e3c294e16f7ef937c405ad99b35299ff7ae3bd2019513a76ea5ba0d4e791f9ad48
- SSDEEP 24576:qLFHjlbUdmDZpQeOdP2m2df7Yy+uUF+vRZbz:ldmv/TY9uUFgRd
- TLSH T177552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\libcrypto-3.dll
- Size 6.0MB
- SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
- MD5 4191d4288230515c5098cc07f699a604
- SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
- SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
- SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
- TLSH T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\libssl-3.dll
- Size 1.3MB
- SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
- MD5 d99207e7e513f87ad7571c4c2450771b
- SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
- SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
- SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
- TLSH T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\libtommath.dll
- Size 93KB
- SHA256 bf18448a56de62e56adb5a50040c08648f0bcf556217de90eca283490ee8c0c3
- MD5 8fba15875ec56759f9300af889066f76
- SHA1 efd8808926ab7418cffd5580b08c6fa24c83bf1a
- SHA512 4e3421805be032eec1bb607470575270eb7aecfd0e65cf44943f61fd2d35178b8deaea3d0c7e4093736f4a4a02c63014dea74f263e8a3d4571b0d996a436bdcf
- SSDEEP 1536:p3RaimSoWEBrh2as3iwaOasKuWoSvMD9NNKyPs5i9XfIY0T:1qWEBkL3iwvrD9NNUV
- TLSH T178936B4BF6CA10FFC05AD5B1C3069313A6B2B9539B266AEF23016E251D16BD06F3F254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\python314.dll
- Size 6.5MB
- SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
- MD5 689a9724a63fb3b4f209c771c31d8a05
- SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
- SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
- SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
- TLSH T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\select.pyd
- Size 32KB
- SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
- MD5 72dd071ef25e5e8f5dbff53efde54825
- SHA1 bbd11e454983ca8b764e32f3e5998d5d80cc94da
- SHA512 d0bb4354c8c3a26b21932d26dd2d4db6e325dafec218680d333cd7507611776e32d8baf9d82d5a88f0ac2f0cdd772054399e0898c9195a07b81720bdec65e677
- SSDEEP 768:SB7YTZnJrqFAIpRGayPsSvPuBL2Ip4j5Txf1mlRaX16m:SB7y5JrqFAIpRGayPs5i9jLfIY1N
- TLSH T152E28DCA6B348047EA62C571C6B2DE43FA39B7A3561186DF31B9919A0E173C1E737318
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\tcl90.dll
- Size 3.2MB
- SHA256 ecf6c76a725d082a0f00c5940d39a5a71087d0e9d166eaa07d1d6b122a195020
- MD5 4484a3384db1ccace8d1d8c1ebf115d6
- SHA1 4dfcda3c1d67a681617ab052cd0458bfb660fd1b
- SHA512 affd19a64a97c59d1d5e896f9b5e11c7012225efdd2ba897d6dda11677bfce8f978fe09cdb8d834da901219f2f12993a1e6781931ccf5ed21eedcba00ad0bfa4
- SSDEEP 49152:mLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugN:0WrPOVNFFvsJnNKfXAqRGYYQ
- TLSH T1CDF5AE46EBA40068D5B7C27CC61ADD4BDFB274581364AADB14E05B612F73FD2237A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\tcl9tk90.dll
- Size 2.1MB
- SHA256 6e81d58860701540042b8168af929c54437b3f4143bf1b8f6114e56c3b9a8df0
- MD5 21f89d187a756935d97d972d80ae5b10
- SHA1 4e95ac93af3f81fda09249181325156b89819bdc
- SHA512 767cbe673c5f323c2711eb42471791ceb1c98c0e1c0061a570a436a773db811318dd93a3faf004b4d61b7f8ccb47aee05c5df7c3c28348e5bd71937bf0ea3560
- SSDEEP 49152:w/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6T:Gs7+8JToVH+M1
- TLSH T12BA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\unicodedata.pyd
- Size 741KB
- SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
- MD5 71e6240fbd8f3fca694c12d8a5e3f404
- SHA1 b7d66c937638526ef1a90f4dbc00ebb8a018778d
- SHA512 d3a3221b28844e9801e1b6f7d6abb88ed65e8b2de8133c925f35fc12f29cc0a7e182697deead47aa4650fb00c34083cb5ca1b45f53317ffc5d22162208dbdc19
- SSDEEP 12288:5IwY/APtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtygF:5IwYI5ZmDPqO54lDJPTMygF
- TLSH T132F4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000008c82\zlib1.dll
- Size 114KB
- SHA256 6bc87ac126b343f794ff14254d2cb6fbfbeef5476c0272e7297c5b4e8acfc353
- MD5 ada9df12e27f3e0fc5cd668cf87d7e4c
- SHA1 34ac2e25f6390c4b81ee65c022a0cf7de4a6f4f5
- SHA512 b27a42a68b4babd9049ce438d484fbc2770ccd5e8ee26faf3b7757a3cb3d8dc877a48d944d21b9f625e50f5602085cce28b1027c88aa40647d5905a02a7c04d7
- SSDEEP 1536:9eKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fBLt:ENGH+X34najvon8PVh2FXws+Zy5LW
- TLSH T14AB39E87799620AED5B7C230D6E65B22F67538810B1C1BF70285E3642F02BD06F797E9
- MD5 SHA1 SHA512 SSDEEP TLSH