Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target 5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe
- Size 10.5MB
- Sample260508-k3e2cae16v
- SHA256 5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb
- MD5 0328cf3576412bc002e89ac9aa28bc3d
- SHA1 f78f3cad00c0b0ab03e7acd756833b7095b94ace
- SHA512 35f4f3eee4a4510e2ecb4bc37185139a2b3f5188f5e1bf34afd1b3b79277144bc1da1bc2bcdbd0634acad6c29c9b970185625c61a5b33251a58bcf487e2eb2b8
- SSDEEP 98304:V6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww7:qdnwRZenXaHH1YNTx9Pe20/aVHdiu6E
- TLSH T1C3B6CF96EB813125DE2E6A31153C3CAB8215BDC91B700BCB96EA7C9445717C31D3AF8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 24 1468 5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1468 5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe"C:\Users\Admin\AppData\Local\Temp\5b8acf392348068ac3f7b403da69324c1584ecbc055c692d0964c3eb38bcb5fb.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
- Size 6KB
- SHA256 84e87e48f94a8a8de71af92f8c1f67e3b246c66d6e1a5dcdea210d4a277a41a2
- MD5 474d7b33bcf77b36ae34497f6a0588d9
- SHA1 0cb00f4abb88a9358b34322ff4f9d9e8e5a085bc
- SHA512 ed3ce11c5dc500a9faceb13563cfa383647660f631b7faddbdf825670b2b29e66ebb6809ba85a254ec4a490ddfb14aae02dc2815eb232ea467847940d0969b23
- SSDEEP 192:on2GBSxxKNisIuITIiDJ+DT3uoET0g24FnkRrYySRhAB31eptA+S5BCozT0g24F4:o2GBSxWisIuITIiDJ+v3uoET/24FnkRC
- TLSH T127E19F707D678E2B3A5F8158DA7E2E52EEC83C4C94148ED5B1ED0A0099E2B12FC3F556
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
- Size 7KB
- SHA256 695c079faf1d6792465b77f0be588fb0727ad6b3a386aa9eb7715122163db856
- MD5 347e29601080e4d192ffb8a5b9078bde
- SHA1 915c68e9281246a1579b948f665dc9372fb7fc00
- SHA512 9a164ffb100405b20119f6d6bf4c50765a8ee02b023d5911c8caa88360a620762327053af3925d1cd18e4d7a56ed6892fbce7405f990a907c208c15ac35c72f0
- SSDEEP 192:on2GBSxxKNisIuITIiDJ+DT3uoET0g24FnkRrYySRhAB31eptA+S5BCozT0g24Fr:o2GBSxWisIuITIiDJ+v3uoET/24FnkRh
- TLSH T11CF1CF707D6B8E3B2E5E8158DA7A2E52EEC83C8C94184ED4B1ED0A1059D3712FC3F559
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Yandex\ui
- Size 38B
- SHA256 23b90192d0d9b13b5f30b93841aa1293308f1e9ccf6381b671141070cb86d98f
- MD5 e5912cc20f53402b45f8f0a4a5a9866a
- SHA1 42b1a79218a619d1e47b4cebe20fdba0cb87804c
- SHA512 01ded47a719529dfc9846068cb2daa4b21e81df668f1fdfe5ec434a16a550b4eb1420d60b2fa6a4b4186088afddbc7afef43476ede991c73b6caae84a7d0cc99
- MD5 SHA1 SHA512