620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11

Analysis

max time kernel
148s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe
Size 11.6MB
Sample260506-trfm6set2z
SHA256 620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11
MD5 7d33377156d7c5c27d8d96acb2cc8d91
SHA1 43f8163c0f0f562ea021d269ca05c2498fda48ad
SHA512 74f6f62c657f20ad2990441dbe5d4538a062890f04db3022273f8e21e4926cdae8fefd9ee3754663dfcdb04fc11bf181cf82284b276b89b37c725841ba52f752
SSDEEP 196608:vBDY7jLIZW9EdvJQO0G4NTx9Pe20/aVHYiu6E:vhY7oZFItGGdCahYie
TLSH
T1B6C6D096DB813129DD2E6A70213C3DAF9529ADC51B700BCBD7EE7C9415707C3183AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	4588	620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4588	620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe

C:\Users\Admin\AppData\Local\Temp\620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe
"C:\Users\Admin\AppData\Local\Temp\620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 a2fd02b6aad6cc1d9cc22e27384a0ddbe3b3c069d5be6523fce1d2d29403688f
MD5 a53770261dd1c876007237c45c192523
SHA1 50803dc4e122de317ce1ee2eee2478b39e729c9f
SHA512 7b250cf92d99925743f9aa3f667577a85368f2fc342018a7b988eb0915b2f9cbcf9e8538e718c5a53ba56f4e963a1438d5eaeb7942afc288cbaa41f3450411df
SSDEEP 192:1qfqNuDIKuq8qRqKrdmfsnTwaT1eHRqEDnXST1WIXLcCyp5i5pmiEsNjwaT1eHRs:tlAf1Zqs6XowQ51ZqstXoFQOY
TLSH
T1CEE1575878B38D33165B62D6E3B93EDA4DCCA0C8304899D262C99AC138DF111EF7F556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 59862bb9cc95340aeb4716a31513a20d528c33fc66c46fda98abdafd8645774f
MD5 79e7be32be779eb12c27dd747be8a770
SHA1 c73f3621132fd363af4af44666f1868d6f57061a
SHA512 e2b1c28d690cb26ad972c94ee48caab76d7a68e19f343d16844fc0e695851d7d792a607088eb029fe5b83433aec7dba5e8d1d3e88413234da0a91f3e91e05789
MD5 SHA1 SHA512