03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3.exe
Size 10.5MB
Sample260506-ttlbfaet6v
SHA256 03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3
MD5 3820bb2c2e06c10cf15e7e540f850b35
SHA1 ac6c17bbf4318d6640c8787100748d54ab023d61
SHA512 af01f71946e50c1395ba45664e8cede4583feb9f0a2d7440c321046768d467b5e38ce798797e78037c0fcaf3c613af069b54257e990ac1fd6e740e6d33b6bd63
SSDEEP 196608:eBDY7jLIZW9Ede4NTx9Pe20/aVHYiu6E:ehY7oZFYGdCahYie
TLSH
T1DEB6CF96DB813129DD2E6A70213C3DAF9529ADC51B700BCBD7EE7C9415707C3183AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	4476	03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3.exe

C:\Users\Admin\AppData\Local\Temp\03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3.exe
"C:\Users\Admin\AppData\Local\Temp\03c1dda8c62ee2b780d8359dadf20a7f01066edcb14ab55f82277634d4048bb3.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 226db103440cb93972cd36624e1fa634ffc7ba0a38f29b7b2324eac9bac27459
MD5 e5b3798da60b6c6c2c8ae6bf6556a0e3
SHA1 74c4b5c5b441d4a33e1a99c14152d4c533356a33
SHA512 b9c9a7176bab5d6b7acff5561388011eea140f215407ad2662c19097db19b17a604d0d9630cfb4b177aca73ad8d1b6bd974da72b92a144a5f6c5982fbf8dfc74
SSDEEP 192:cQxpVARd19YQIFpyclfo9QNFpycl/o9Q6V2qgtsnU:bpKRn9YxFpyclfo9QNFpycl/o9QEgtsU
TLSH
T15E029F683DFE89B9171D41D4A56E3DA08DFAB01CB21845E0B1FE12D568C28147EFF1B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 c2f6ad032a4f9fef6465544dd366d327ba3a36a6fe64efd465df926d511349f0
MD5 d44c0a149294cebab01f02d39ad2d0bf
SHA1 684731a49f108581afea17bee6d0d0c73e6bcfd1
SHA512 46bc012a3b8902bb689682229163d7d5e5fee6a2a15875903d4d58cc1aececfd46278d1bebfb9d349f1dc63d20b5df438160c0097b472dd365f9495508a94820
MD5 SHA1 SHA512