1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe
Size 11.6MB
Sample260508-2mcdysfs7y
SHA256 1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4
MD5 89783c94ec99538791a7054fb9caf10a
SHA1 77e7b894b760be66467dfd055343d6ffed94fda3
SHA512 9282dd2ad0a02398ff573f9e53d2814b2f822a8cdcd038efb760c7b229950c4d3af45fe00b676f1e1256809d0e995253505528da72beb7061e5b958c418e20bc
SSDEEP 196608:vdnwRZenXaHHNg5lYNTx9Pe20/aVHdiu6E:vJwRQnXstgHmdCahdie
TLSH
T1EEC6D096EB813125DD2E6A31153C3DAB8225BDC91B700BCB96EA7C9445717C30D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5116	1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe

C:\Users\Admin\AppData\Local\Temp\1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe
"C:\Users\Admin\AppData\Local\Temp\1a3f5a75fec99853b054f32472d4c94db527b0b45006e7778d0be86a62b013d4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 ff9982c317619ad4bb030584fc341348dfd71a1414232eea653f4c0ca65794ef
MD5 7602deb24cfaf812ec3f950e6c560ea7
SHA1 9195004f96e422f71b0042611963b464aadebc2c
SHA512 b0d3679ac813027dffdd3a7ccc7359b9a3ffbc24f06ae50339a1e9ad0ebd883c78f7e89ac41e17cd78a632d269518c6354b42d63127d3430c666ffff7d134b23
SSDEEP 192:K6l27HgCsdXvihZXjCVgh/iix1ALUuIgh/iixtALUxUU:z27ACsdXvihZXjzh/iix1ALUurh/iixF
TLSH
T1B9126810BCF29D22361B65E5E87DAC55CFE9320F90088DD5E5CD8A88A8D3531BE3F856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 738a82fcf9f2a29142bcb55c50db956d4d3d1916cbe45a3dd211f0cee3673660
MD5 376d779882f40212f93d1a187457cf3f
SHA1 b2fe8a81ddcf2f73efa4886236e1b569f2942ad5
SHA512 168cf927fc803777b276c625985d1ba2745ffb2a7a944c35554ebe8a9fd79f718056ed689b58b9cbde3492ef29346d8da69b297860d051a2a7b177bdf218ea43
MD5 SHA1 SHA512

Submit Download

memory/5116-177-0x00000000063B0000-0x00000000064AE000-memory.dmp

Download

memory/5116-227-0x00000000063B0000-0x00000000064AE000-memory.dmp

Download

memory/5116-229-0x00000000063B0000-0x00000000064AE000-memory.dmp

Download

memory/5116-232-0x00000000063B0000-0x00000000064AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads