Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 12:43
Behavioral task
behavioral1
Sample
dk.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
dk.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target dk.exe
- Size 7.0MB
- Sample261002-pyex1asfng
- SHA256 85c1b2cfbae83a67aef4ff780dbc26505a166e309a9364f7998c88d6b666bcaf
- MD5 8f6aceedaf1807f29473b172e3250c7b
- SHA1 d98e63677817d8e80b56acedeeb831eab5746836
- SHA512 07049837c7da3a56109e5051108717115c280db1d2442afffd973e6a3c89857e495fedb43e18d122da8a402e49e9232257c242b27bc81467ec471824fbdf6224
- SSDEEP 98304:M81Vj0nfhop7Cxlj/v8aL/3GfNi50p2l7TJJzpK2O5nDcJZR9fY6BsGhxEvea85s:MoVofhcen8aLMA7h5kSZvxi6/
- TLSH T1CA763368A7B208F7E8679239C8E291BAD5323C164771C6CF52F486633F732E16939351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 2056 dk.exe 2056 dk.exe 2056 dk.exe 2056 dk.exe 2056 dk.exe 2056 dk.exe 2056 dk.exe 2056 dk.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4436 wrote to memory of 2056 4436 dk.exe 90
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\VCRUNTIME140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_bz2.pyd
- Size 71KB
- SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
- MD5 8d28cd65e4ce6ca79c326f9daf2e0a67
- SHA1 286b4fab4996a2d90e85664bd4dca3230dfd3ea6
- SHA512 8f5cd8c289be8ef87a94ed8314796f4e2be9d3f08c89dbca81452784723a4912142a58bb4d7565744c1a5691403b9d1084050f58bafe48b8ea3f902b800d3fd2
- SSDEEP 1536:AENENz793YK4ZnPnomCNsD+Zr/E/8dDCIaR0IKIECV:NENzxoKiomjKpEkdWIa2fIECV
- TLSH T11D634B56B7B666F4F46F90BD8A410323E330BA55036063AFF148829A3F13BD1AD78356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_ctypes.pyd
- Size 116KB
- SHA256 c10b0b0f800c1327cb627a342b9afc5960d436e9e08b02f5d6971da69e4722c5
- MD5 a3f5a43eb7c25cdd95b7de6a3daee87a
- SHA1 85e7bb74d35a08b9b8057beb4e1dc4581d754ec0
- SHA512 698af97a5b9ae1bc28b844e2bf38b518d428ea864dcf8f90fc134439ff8cbd816a9eb8d24a80c44859892655115271bab3da07ae04c29bba25980a7ef9395fbf
- SSDEEP 3072:vsSf7AbHKu8eeT3SthgFbqLfMIHzzyKs1p1trIELP:vs3KcoygifMIHj0l
- TLSH T1C6C36A0B33980099EBA7517CC5735E47DBB1B859472097CF0290CA992F63BE26E7EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_decimal.pyd
- Size 237KB
- SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
- MD5 a80ed1383173049f9b26ea01b27fa058
- SHA1 0e0c9361f18c4df41a8d13cea3c34c66367989ad
- SHA512 a8f60aff4123565e5aa2a4977e71e6de386deddf267f9cc3d1d8caa170d66fdf8b5518f54a1c9aee18fe8108cd99bb687ace83c524e05738c31a6621f4dc5856
- SSDEEP 6144:HXOksyljLGY7iCIH1VA2Bk9qWM53pLW1At/Idtz:HeTEjiY4H1VA6ln/IHz
- TLSH T1E6345B5AA2490DA4EE778074D8579F47E7B278940360C3CF43A48AA73F576A323BE744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_hashlib.pyd
- Size 52KB
- SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
- MD5 1a99593df5483910489b9c16cce25b18
- SHA1 ef4f8488301577e7a53c2ae354acef37f24ea649
- SHA512 3033b22ff61ce6d7ebcaee1ebebd68811e07c5ad5c25a9def226e6982b04fa5ddfce55e6213a2db5c5e1f8a271aca26797c4fcf8b1a8d20fe7b560512bf566e5
- SSDEEP 768:lKyUPw0PnfpXx+TSRN24ENp+nfEZWKM0IyIEOIv:lKTY0Pnfph+2YzNafEZtM0IyIEOI
- TLSH T19F33490AF29100E8D56781B9C9A31E87E6F2F15417107BDF4368C28D2F237E396B6B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_lzma.pyd
- Size 149KB
- SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
- MD5 38315a763b4266ad431762f51960bfc4
- SHA1 f0770073b92879bbd3dd4bcfc254cb233e30ec79
- SHA512 bfc3d1144078925d2a5f37c555d6deec3a85ce150e6a357cd2c146e19360f630b08bb504e1b77a30b6fa035c6e157fcb904be021e771ae813e3172e545ba3187
- SSDEEP 3072:ohyN1RbBHQrnoe6r5NJuAJKlo/CznfD9mNoKFz2QhskfIEZ1:eQvbBwcVN0FR7YOKFlsk
- TLSH T10FE31891B254F4D6F2228C34C9274F27E7F978495310A29E01DC837D6B2FBB56A6A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_socket.pyd
- Size 66KB
- SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
- MD5 3a13308b8f79efd613fd25f8a092e84f
- SHA1 a8a09c96de0e37c117b7ace8adc3150cef1b4e23
- SHA512 5c300391a5155a50ca1f81cb1667072cd139f4a4a0ad926446040fbb20603151ece5c7bee3f5d49afdc231fa744742180937cb9d6a4c0fee9d669d963202141f
- SSDEEP 1536:3/mbt022h0Y9/s+S+pzMEnrIDOMQLF/0I+IELw:PytbxY9/sT+pzMEEDOtLqrIELw
- TLSH T150633A10A3A051B9D2B3D17AC6335F62F774F4811399A38F4564CA6E5F23782DE3AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\base_library.zip
- Size 1.4MB
- SHA256 2bd1dd1ee81c4880d95712c733d630209a8feda6b0c3babbe4ffe2126641b3a3
- MD5 19bedb005021c36de987364e242aa335
- SHA1 ccdb0c4b2e5e88d500316c6e6864a33f2cfbea14
- SHA512 4188fb275aafd62723884a879e55971941db3e5ec8192c6990ffa57ec4488f0d8b7886a8188ab19601de5dba431c4001ab0fa1a2ed683e7023dcd015978e6212
- SSDEEP 24576:FT4hQR5pLHHY3fa5PydmztfR53cnz/bucEvUFi93Qjwhd:mQR5pU2fRDS4
- TLSH T1726509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\libcrypto-3-x64.dll
- Size 7.6MB
- SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
- MD5 ea124141d5b123353e0141568c373c18
- SHA1 db302d86966ca87a30859654a86801cd12ca3519
- SHA512 b1befe38003b82c35da945f68f116af9a1f9be447618db88b36b89e2e87a70b8706bfce143fbd6f7c7e9efdf840f65ef0cab1062a727cfa22b8f7b62ad7fa5e4
- SSDEEP 98304:I1fp/3ffd/Mjy36hTn4pE7Qvy+b1CPwDvt3uF90CZW:SfpuHEaC1CPwDvt3uF90C
- TLSH T182862857F6BA10D5D8FAC1398293323BB970B86543B457D3A60095AA0F33BF8A93D744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\libffi-8.dll
- Size 27KB
- SHA256 d56b5e5aa064e35f9ae5d11d2f0833a591d946bc04b85e1772ddfa7c84eb33a3
- MD5 3544abe52bd2cc086bb40be378c0b6a0
- SHA1 e0a1a2bdb577ecb3882b704b2c3d6105f36f18ee
- SHA512 7bd64ace9c59bb991edde75ddf3978905de8634c865bdd70da244ffec00e90ff55a23d0ac48e4b5628106a3a6f8916b4f5ee5eb8f6634c1e1221a2fc7ea8e286
- SSDEEP 384:FZI/wgEI7ztptZKrOdS9LNdPlm05iq97HeE6H1rvMPVRCXv30vG:8Q5lN7m0QqkN0w0+
- TLSH T121C23947A59415A4E2A7C03D86339D5AC23578351B60F6CF03E192BE2E5BAF9DB3C308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\python311.dll
- Size 5.6MB
- SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
- MD5 0101e392844bad69ff3d24fecd3df2b9
- SHA1 1094e6a4a91bbce91d29a0e00fe1ada22fa43be2
- SHA512 a27d35bae06d16e35b8e92812ef731274ded6c464634d91382b916a8ef774b4ace936ce3e0294f891db5f67a1375aa24b97b404d796e980eb3617fd1023937e5
- SSDEEP 98304:M1T5+PMGxsz72Jbor8fhZUFHnMPHVjrK:M1T0xxS2JbowZPZ
- TLSH T17E466C21B26489A4C8BB8536EE6B435AC7717C106B11DB4B5164B3EE2F337530AEF349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\select.pyd
- Size 18KB
- SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
- MD5 c381e282961528e818c15688ee643dea
- SHA1 46e782d807af3b725c96be2acf51c09c2e929e6b
- SHA512 eded4e4554d9e29f49e0d94b2a6f88240f9ac0bb98520ad4f0e9adadf1adb24846d20641dce78477b720f58adba5018610ed0bc362f9116eee5742a5d11ba00b
- SSDEEP 384:Uar1fP1/pqOLlxHqP0smv7AzN57Elna0sj+IEQG:vh1Y4xHqiWOla0I+IEQG
- TLSH T107824C46BBB090E9E1A2C1B3C9770F11D936B631472543CF23A4866D2F27BC2A736B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\unicodedata.pyd
- Size 1.1MB
- SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
- MD5 6b6a5ea52f84c51f18279d668e620ee4
- SHA1 0d474d67a95fa0aef37671a8bc8d96c19b820c36
- SHA512 a1e2de1dc529b5b36ee69eef29c3378dfccc396cff53ae8933a1460ffb05414c31a83796fb55fb564cd07b146862bb86352dcf0fbc67b3872715405d2c52adb5
- SSDEEP 12288:VdlYbfjwR6nbeonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDH3:1YbMT0IDJcjEwPgPOG6Xyd46H3
- TLSH T1DA354AC9BB828D66D87B317944D2212F1361C272476B233BB65513285C8B3B74EE6DEC
- MD5 SHA1 SHA512 SSDEEP TLSH