da26215a73728070548af4c9f0612389e8cf9df1f9963068fca26117eff8d19a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
langchian-0.2.5/setup.py
Size 496B
Sample260421-j734ases91
SHA256 da26215a73728070548af4c9f0612389e8cf9df1f9963068fca26117eff8d19a
MD5 044cf936b1012285e3cd91e5e6126fb0
SHA1 39b48cc506f92f5201cf3f040f7bbecfcdf0d166
SHA512 4c67c358e20262347b32eeec3d0c6fd580d51762dc98891dc0ab0b4a9f3df5b2f526f2ef1a6f3df9c99cfcbaad60c8a994cd7b2a23c7e6dcf2a378ec3e228517
TLSH
T198F0E5F3D9955D5826B08A8E84764412F125E72F9712608B7B7C038C9F72042CD0AAD9
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
852	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\langchian-0.2.5\setup.py
1⤵
- Modifies registry class
PID:1432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-1-0x00000295BCB60000-0x00000295BCC0F000-memory.dmp

Download

memory/1432-0-0x00000262871B0000-0x000002628725F000-memory.dmp