2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1.exe
Size 11.6MB
Sample260506-ts7s2set5w
SHA256 2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1
MD5 58bc48f5b4f45025e4714657c5e49808
SHA1 b8ae7d378c577781f7c9ea1b3539f149fe650405
SHA512 8660e712774e97bf66ec19641db4f70a8bc05fb68b5d7df8e901da24bbaf27e84108a41ef19c914741ba59d67361990ca2292e9c662c627af3b1373d3b78e832
SSDEEP 196608:vBDY7jLIZW9EdvJQO0G4NTx9Pe20/aVHYiu6E:vhY7oZFItGGdCahYie
TLSH
T15FC6D096DB813129DD2E6A70213C3DAF9529ADC51B700BCBD7EE7C9415707C3183AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1.exe

C:\Users\Admin\AppData\Local\Temp\2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1.exe
"C:\Users\Admin\AppData\Local\Temp\2370dada906407002d5a215828ee69a1946b5fa438d4a5c05fb613b5dc4129e1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 9KB
SHA256 6a079a6e3a6fa082929ca72e59fbb5cc4580e89007b85db4435b4c7fd107084e
MD5 c5efbe1d4bd82997a78620bef21d6e54
SHA1 e6d8c54ff2ef0a4dd508c725a002fce5b671ab9c
SHA512 56833271e3fc528bb20aedb22e2261a6bf132c0286d4d23a4b35d4352a50b750a4f5334c1cd859064bb8fc07fbffb86b12e020c342fb1547073f4ac7cc1fc331
SSDEEP 192:4WuWbQP3sS81+q2rjP3sSz1+z2eP3sSzt+z2uFma8pgFU:XuWbQP3sS81+q2HP3sSz1+z2eP3sSztX
TLSH
T12422289A7C77D93F3615A194D3B92ED16CD8300CA82849E1B1CE06C0ACF2A597D7F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 6a7a0570ce398d32a749bf6b2fea782a011dcf1b2fe1361516981a9d1b9dbd10
MD5 828a7a22f703e8d98e3a8fdb7b7eb345
SHA1 a6618ded925101b927323f0948ff676ac44af9c8
SHA512 7274c463df87aeaa177e5e338040831476ec4768844a89f637f043ba610ca47a234e1656e454808f65fa74170af14a38c2c77bcfaac351fe75fb6da68ccaea40
MD5 SHA1 SHA512