Overview

overview

7

Static

static

3

bot.exe

windows10-2004-x64

7

bot.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 10:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bot.exe
  • Size 77.3MB
  • Sample261110-mv8pssh131
  • SHA256 d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bot.exe
    "C:\Users\Admin\AppData\Local\Temp\bot.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\bot.exe
      "C:\Users\Admin\AppData\Local\Temp\bot.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:2204

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_bz2.pyd
        • Size 85KB
        • SHA256 9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_ctypes.pyd
        • Size 139KB
        • SHA256 adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_hashlib.pyd
        • Size 67KB
        • SHA256 9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_lzma.pyd
        • Size 157KB
        • SHA256 9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_queue.pyd
        • Size 35KB
        • SHA256 51a3d8e40b061db4fc77f9a3b18e6c2f912c4edf467e46c95ac325d35f2be4df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_socket.pyd
        • Size 85KB
        • SHA256 11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_sqlite3.pyd
        • Size 130KB
        • SHA256 33e91d0de7924180012c86efb17611ec589b93f90b321ed9ec3c2f4c99fae5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_ssl.pyd
        • Size 188KB
        • SHA256 56fdbe70896e4b3c6d4e8897fad1d011129354172566832371289edca0d85a21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_wmi.pyd
        • Size 39KB
        • SHA256 c8f6705d2da1be12b10050a1311b7c865fd79f11404cfad1a70b3f8962051056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\_zstd.pyd
        • Size 491KB
        • SHA256 7a7b50c580428daf3d43c87b121988d2e8c7af9533fa2195f1aef8652fc2c489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\base_library.zip
        • Size 1.3MB
        • SHA256 39fd9bf7be2f8b945e3d141a1340158d3c38b9988b376637547ed8c3a0e4e82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\charset_normalizer\cd.cp314-win_amd64.pyd
        • Size 116KB
        • SHA256 2fc82a309cdd4499e5dba1a87671f9ac3a3a35e44008afafd7867888d400f3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\charset_normalizer\md.cp314-win_amd64.pyd
        • Size 206KB
        • SHA256 ca72897ac6a6aca48bac72b409bb3cbe6326b755b37d733cad731d5624e17f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\cv2\__init__.py
        • Size 6KB
        • SHA256 674817e87409bc589608ef9f4dd4c1a49f600b5e85ca8b106b3b0a9eab5c46cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config-3.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\cv2\config-3.py
        • Size 748B
        • SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\cv2\config.py
        • Size 123B
        • SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        load_config_py3.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\cv2\load_config_py3.py
        • Size 253B
        • SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        version.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\cv2\version.py
        • Size 96B
        • SHA256 fc17efee9203c23cac641981068621e80d3b0bbabe459f4133c9b2b4d91957fb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\libcrypto-3.dll
        • Size 5.7MB
        • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\libssl-3.dll
        • Size 1.2MB
        • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
        • Size 19.6MB
        • SHA256 ed4f167a5330424524f45258e7ca2c8d7f03c0cba1f30ee4985553ac1f88ecf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
        • Size 3.7MB
        • SHA256 71521656365044a41c155d5e7c2caa47cef75a5e120e93afb82c928484aa82a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
        • Size 110KB
        • SHA256 e14722dde128b4874187c15226b7d4c76d84fd64b12ac91118ec1da5b7b8d348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\python3.DLL
        • Size 72KB
        • SHA256 7bb0a7df2d5cb829319dd8d122039843e2a762361bb5a61bb5d24ca34f4040b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\python314.dll
        • Size 6.5MB
        • SHA256 d8a06cc6ca3348925ea29e343e1c5c5895fe0bb433ff913e1cee44caf358aa6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\select.pyd
        • Size 32KB
        • SHA256 0da869c017fd3231cfc1c1e4c4bef1bb7bf5cba38236e6d7bf1630c3507c5a1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\sqlite3.dll
        • Size 1.5MB
        • SHA256 99c296ca2b4372418edbdcbd923ab0df2cdbcf406782694d7376f2b01e5010c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ba02\unicodedata.pyd
        • Size 740KB
        • SHA256 4c4e9f9e71e299a7e0093830e79f955f2b12b4eb0a6bb45003d42256b6e5985d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2204-219-0x00007FFB31820000-0x00007FFB32BCD000-memory.dmp
        Download