1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe
Size 11.6MB
Sample260508-2mcdysfs7y
SHA256 1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4
MD5 89783c94ec99538791a7054fb9caf10a
SHA1 77e7b894b760be66467dfd055343d6ffed94fda3
SHA512 9282dd2ad0a02398ff573f9e53d2814b2f822a8cdcd038efb760c7b229950c4d3af45fe00b676f1e1256809d0e995253505528da72beb7061e5b958c418e20bc
SSDEEP 196608:vdnwRZenXaHHNg5lYNTx9Pe20/aVHdiu6E:vJwRQnXstgHmdCahdie
TLSH
T1EEC6D096EB813125DD2E6A31153C3DAB8225BDC91B700BCB96EA7C9445717C30D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	3464	1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe

C:\Users\Admin\AppData\Local\Temp\1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe
"C:\Users\Admin\AppData\Local\Temp\1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 7KB
SHA256 73adccedcbb7a630d53ee25c396d0a56cf8250d5f7a9ce8d3962a0cc3046f310
MD5 a07e9dc2f1e5bbae4b540128f9303e36
SHA1 42e1687d483ffc5d26b9d31a243e465f816fbd6d
SHA512 c1b4b47ba8cf9b044c7e092b89e00f36651aa22f30f7b7afbf4eda7c80aeda1b2dcb632569f651719b53e390080f3afcc3d580cd2470b37473dfb2f74e709959
SSDEEP 192:O/Xd4fgxVS0+LIg0yCHgxVS0pLI10yagxVS0p7Kn:8d4YxVS0+LIg0y9xVS0pLI10ytxVS0pI
TLSH
T1B9F125127DE28D222B1B65A5E17D2E64FD8D312E241C89D2A7CD0F11A8DF910BC3E47B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 256221635086fadc198c26bc0a30d36e9ccda8c2166843e748e60e515c3b364b
MD5 62647f9ae03ce95d97add91c5e710adc
SHA1 4a823e33c10b29b005983c07747cd89e25458c9b
SHA512 3800b88afea4abdb22bf609674137d361cc60ee303b5652f1d1ce7677d8008f7d9e87204628e597284a49e7e7cf607e18f67c5fe225b147e4fe2b1dbf3463fdf
MD5 SHA1 SHA512