9d2a8149f4332ed683768047d308b0f8e9eb5431455036bdf4a28bcdc6ff1749

Analysis

geolocation tags

eueuropefrfrance
max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DCK/lib/functions.py
Size 158B
Sample260416-xd8ctact91
SHA256 9d2a8149f4332ed683768047d308b0f8e9eb5431455036bdf4a28bcdc6ff1749
MD5 24ca20863250680509b2ea47ebdcb7d2
SHA1 50eb964b83b6af5abac7cb2b4536ea2a0c3b643a
SHA512 e6ffd921f516bfe9fdaa7aaba4efd7063829063ff77b52753d91af9c608c6d56ed4140b035e515323535cdbc29f779caeb8824398070c50e51eca209af5294cb
TLSH
T164C08C6320A7B169B077F2E0A86B21B07AB0D352AF09000424A26BED06E140CC8B101C
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3436	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DCK\lib\functions.py
1⤵
- Modifies registry class
PID:8

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-0-0x00000198713F0000-0x000001987158A000-memory.dmp

Download

memory/3436-1-0x0000019E49060000-0x0000019E491FA000-memory.dmp