364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe
Size 11.6MB
Sample260507-sphjbafs8v
SHA256 364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975
MD5 cc910ef30559cd2fbc64ad8af014f9f9
SHA1 4460e35720553e13cb99b950ea797392d4396ac0
SHA512 10ad1654b7ee1885edb0d50417709a1331fa528d9255eb526eb2c6337db8836e392ba87ec076ad81edbcdeadc076f59eae45ff6470dc6277e95907ebe5e0e705
SSDEEP 196608:HBDY7jLIZW9EdM1l4NTx9Pe20/aVHYiu6E:HhY7oZFq1lGdCahYie
TLSH
T17FC6D096DB813129DD2E6A70213C3DAF9529ADC51B700BCBD7EE7C9415707C3183AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	824	364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe

C:\Users\Admin\AppData\Local\Temp\364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe
"C:\Users\Admin\AppData\Local\Temp\364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 8cfa53c3f79b7c85e60bf223cf42205119f6e0dd73d8c7b3f687db5fb384cdca
MD5 50b8d39f418e7632a4b666094e90e069
SHA1 cba3eb9657c187738ba7385f82cecccd3e8448bb
SHA512 f5c52a936ba49dcc66347b5a7a14b69c6f7d688458730a6a34918886a7d2d1c01abe54d5de56d29347a40ce8c29c4617d19a37090dd9617199dc9816e2c282ef
TLSH
T1B141F210BFA58525168C812A51E50C81EF18BEC47B28F7E57AE650E50683C663BEF165
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 9KB
SHA256 5812bfcc27852223cb064497a3c2aeddee1a8fbb4741929f892f1c9001f0e8b4
MD5 baeefd7d3fbc41cf986d659b29feb500
SHA1 7a3d6cc9abf8dbef67d7e29d05fd534106538e55
SHA512 952c836f1b926966013ac046e62e4c667990d6c3be1aea382a9098d5fc4d9ee60bb27d691044d8a3f59402a126a8fda27236ef5ac35f6ad400fa34fe2601190f
SSDEEP 192:qTfJjb6ElfHK5h/u+6ElfUM7a5PAezx+c7a5u:qfJjb6ElfHK5h/16ElfUM7a5PAezx+cx
TLSH
T14812CE653A62C5721A1E41B5D1EE2C52AE8C3F5D1200A9D4AADE80C20ED3D1A7FFF177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 b8de143e0512fa839c880857cd9ef441561a2a260d475a2bd2117f0c295ccf6f
MD5 043206de92e153784b8050ed121ddc41
SHA1 a1b00143d195ef212c9e8a38b6452d35727a79e9
SHA512 da9808923cc3ef08fc13bbf258ccac2cb1d1e917bd268bc876dc9f23bb9d6912e6d93b9161885f39df3a73e35731cddf463e8e57e84b15af42a5c341c3443265
MD5 SHA1 SHA512

Submit Download

memory/824-172-0x0000000003770000-0x0000000003789000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads