b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1

Analysis

max time kernel
150s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe
Size 12.0MB
Sample260511-1e88aaew4j
SHA256 b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1
MD5 35594d741da34453cf363fa064b45e67
SHA1 300bb2ae4c957034068c716d8418080d8581f6f1
SHA512 be54ddeb666d3d51b8a3805f9c8f78c7777116a018dd53d4a95aaabc9295731d31eddccc8e995949237fddb2ee8806c633d49013e4f98d5c3b034dcaf68917af
SSDEEP 196608:AdnwRZenXaHHcT0Q/tCYNTx9Pe20/aVHdiu6E:AJwRQnXsw/tCmdCahdie
TLSH
T1E6C6D096EB813135DE2A6A31153C3DAB8215BDC91B700BCB96EA7C9445717C30D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3000	b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe

C:\Users\Admin\AppData\Local\Temp\b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe
"C:\Users\Admin\AppData\Local\Temp\b31add0e142bde40e99ae15b1aec649b057804a530f8c72d10759e1ed1f607b1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 1KB
SHA256 fdbfcb45e204056979bc97bbb8d7a2dc76b35c5657ab1a368b285c250df72428
MD5 5bbeab4832b0cab9f88dc4966efc05a4
SHA1 94b557eb944c37dad1056a3f0656ec639401a822
SHA512 63775f379c642c699da78e33713e8c33a8d787d509728c8a35054bb979ebadac3f1f643537f5e0c16632e0abc59482a4d0c90871f656429fd1ddcbf9ac940cdb
TLSH
T1AA41CD0A7EB01939378C995EE1721A54CE257D86BA3CC6F93EB5045026DAB703CEE028
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 5KB
SHA256 634ddd63ef504741cfa7152b982a8b4f4f6d38ca9573b55a59c7d95303131a51
MD5 1fd7e67be48b0cbd7a85bb7af1cd5e26
SHA1 8ee2ea3b84d40e15f244eff009fe446640e7804f
SHA512 5a314d2810e951b415258180e30079a81e310ed28294bbfca9d177c4e46e8a5922d73b32b1cbf1419f06093a01cd472ad000bf69a9ccd6d493ee4507efa510d6
SSDEEP 96:K+xTVgS8RjHNH8z9HXHf0H47DHECHEgVHEhHE9HERHESHEvHE1HE08HEHH7HFH64:Dh8RAgRjOaeBsSEDvgRjOaU
TLSH
T177B1BD0B39709539361D6A94E17A2E508E9D3D0A7138C8F97AFD00417AEAF343CBE42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 391bd4ea3e92bde1ace4dc41d8baeb75908d27f049c768abec19ac55dcacdf7e
MD5 31643995d694e34cff16d2031713b0b3
SHA1 30d4fdf5ed3466819b42585c711060edf2dfc57d
SHA512 e6125d4d8b113023c5add19a92a1b18eca21581ee56be84eccd3bdfe0b819cb4d263a6125ffcab4840ea839094a3c1b83fe152592e303e379a1add385f823a2f
MD5 SHA1 SHA512

Submit Download

memory/3000-181-0x00000000034D0000-0x000000000375B000-memory.dmp

Download

memory/3000-237-0x00000000034D0000-0x000000000375B000-memory.dmp

Download

memory/3000-243-0x00000000034D0000-0x000000000375B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads