364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe
Size 11.6MB
Sample260507-sphjbafs8v
SHA256 364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975
MD5 cc910ef30559cd2fbc64ad8af014f9f9
SHA1 4460e35720553e13cb99b950ea797392d4396ac0
SHA512 10ad1654b7ee1885edb0d50417709a1331fa528d9255eb526eb2c6337db8836e392ba87ec076ad81edbcdeadc076f59eae45ff6470dc6277e95907ebe5e0e705
SSDEEP 196608:HBDY7jLIZW9EdM1l4NTx9Pe20/aVHYiu6E:HhY7oZFq1lGdCahYie
TLSH
T17FC6D096DB813129DD2E6A70213C3DAF9529ADC51B700BCBD7EE7C9415707C3183AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3356	364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe

C:\Users\Admin\AppData\Local\Temp\364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe
"C:\Users\Admin\AppData\Local\Temp\364de1964b37b7928b68fd06303785e8e48a28f50032d7dcfd5c97f8d15c6975.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 8ef538a0a0d49675c7f0b28bdb9fc3db9f3d42c18ad3e70e6be27c0506f40b25
MD5 789d31a85ac5c3d3ddf117e27e9beb71
SHA1 a6ff20094b08095f8b4903804276d5eb68e9f1bf
SHA512 af9bb23bec54029d1e2f1265bceb5bd3792398896b30ea456146efd8f1da9b647da586fc56dd21b4b6e50ba06153be91026af4370fbbbbea1f93001f03288bed
TLSH
T18341D020BEA309351A88921AA1B80CD5EE8D7AD4BF169FD536EE10848DC38315BAF1D4
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 d03ec988bff5c19dda3d0e3365d4f554b5c91d00c07a61ead6bc8a0c2a1feb5a
MD5 342890498874d3bb74240e40ed007978
SHA1 b82845bbdddc2de92e6b3bcb6b76d904af9001fa
SHA512 5c9b3378927c9e351d909be0b51e81f246731f0a9402ff645982b9434009eaae5ceb44529d4fc1f375f1997b742037cba50012a7ee01ad9bac1665a32c395663
SSDEEP 96:KBRufGsRbDO3HGHHIHFH3HiFHEyHEaVHE1HETHEZHEIHETHEPHEU8HEJH3HDHaHL:iUJDOxhxSQG/QMkRMhxSQR/QjmN
TLSH
T171D1AC103DA385291A196294F1BD2C99FECD3A98AB179ED875CE0080CCD3A156EBF295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 48954777502e0247eb9cd5bb8da47c0225f75e0747bc9571572ca93b3508d4b7
MD5 62967a12bf15f8f68f6cd08b85a7f529
SHA1 56fe5bd51feb244352fdfb70bad9f9804ab8773d
SHA512 9c363fe45a0718a6bf9478cb2df77955d4212efba0479bd42c0c5d68015d0f2d4bc93d95139f293d2036979b4192fc5dbf932eb432d27099c1a16a75074c9dfa
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads