b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1

Analysis

max time kernel
148s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe
Size 12.0MB
Sample260511-1e88aaew4j
SHA256 b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1
MD5 35594d741da34453cf363fa064b45e67
SHA1 300bb2ae4c957034068c716d8418080d8581f6f1
SHA512 be54ddeb666d3d51b8a3805f9c8f78c7777116a018dd53d4a95aaabc9295731d31eddccc8e995949237fddb2ee8806c633d49013e4f98d5c3b034dcaf68917af
SSDEEP 196608:AdnwRZenXaHHcT0Q/tCYNTx9Pe20/aVHdiu6E:AJwRQnXsw/tCmdCahdie
TLSH
T1E6C6D096EB813135DE2A6A31153C3DAB8215BDC91B700BCB96EA7C9445717C30D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	816	b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe

C:\Users\Admin\AppData\Local\Temp\b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe
"C:\Users\Admin\AppData\Local\Temp\b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 1KB
SHA256 721bb4e9d2cd016146309f7b096ea5019133f586fafd341c048d2132436bce35
MD5 ce0c72a1e45866f801c5f22b5e5870e9
SHA1 09568793ab029975bb82beaee2dde1cacb00c53a
SHA512 27dc182ead329eb997272638fe0c7b9ab79b041517362d48454feffc9f416b10a75388bd356e09fd0bba38d7f264ed87daeb43ed8db97e53817805c0c6917929
TLSH
T1F341BD0F7EB05F39178C825E62770A91CF247A86FB3AC2E27FB9545416864302DAE039
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 7649659d406eba423f6949ca8c8e0c4bcad88324a1a1a8dc5edb9149022d6c00
MD5 dc0490190931f5a4d15d756c9d0e4db0
SHA1 86a53679c4590cf4f2ad3a34748846485053d190
SHA512 210eca242db446142db56c8b653caf9f0a615b38671fb3e18646582ae1fae65ecd0376b4cc1b5e48c4cc25ea99f16de9d8b9aeda7656fe9d58bb2d3ee018fc81
SSDEEP 192:FFIl3AgIqvpdgnvhsXgIqvpegn6hVgIqvpegn6hy:3Il3jIqvpdgnvhVIqvpegn6hmIqvpegh
TLSH
T1A112380B3870DA361B1B56E5E67F2F515E883A1AE264C8D17EFEC5005AD25287C3E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 d0e426f08bf2c753667689788febfde0f3a6a3d3a483aa40887bcb88c5412805
MD5 5843075e475d081ffeb9065308adbbae
SHA1 6d7cf92a0ad8e0aabbdf5f445fe986bbd9578dbc
SHA512 c96fdaa85996635e0aa292f6b1b7e0cca3b4437f95e4d4e2e9fdf5d541f6d79cedc75b1e57ff6a77066619cb8a7bd59d547c3143d187eff9e231019d4ee5711b
MD5 SHA1 SHA512

Submit Download

memory/816-164-0x0000000003550000-0x00000000035E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads