a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe
Size 10.5MB
Sample260511-ntdzgagx21
SHA256 a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd
MD5 eba240c70bfa6136339184045891a6c1
SHA1 50c8f49a8a147a06b3168ee990e6fe2974f461d1
SHA512 92754d3b11a6b6b3e23b528b093ce73b82a6215e546859d9e6aaf6e19c2fed07be472a5752642d3ec50616887b47369da80561a9a85fe5b6c43c15d30ebb2075
SSDEEP 98304:V6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww7:qdnwRZenXaHH1YNTx9Pe20/aVHdiu6E
TLSH
T184B6CF96EB813125DE2E6A31153C3CAB8215BDC91B700BCB96EA7C9445717C31D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	4392	a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4392	a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe

C:\Users\Admin\AppData\Local\Temp\a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe
"C:\Users\Admin\AppData\Local\Temp\a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 c2c70064be74ccd63a5a0cce917daeff7801ca730e041847c424aefa37643cf2
MD5 c50563e216aaeab3699be199ffc933b6
SHA1 49974fe06710bd6ac567c17e2ddb3aa5e7a28d85
SHA512 1a4aeac7ed4980a87a9ab5f022e2d17d822b4abd0b65028ef9aa9f0d762e45772dc268fe22dc5be60887b5a8d7b3eebffa8aea715b6b15baf7ef2d4a4649312d
SSDEEP 96:KZ0wY8y7Fcf2SS363H6HfrdPHXHGHcbDHExHEbVHEWHEqHE7HEXHECHEFHEf8HEq:tmQaeB36+Fg+21ZY0RCrZg+21ZY0RCrW
TLSH
T1D7E1BE0238B9CD25165942B6F5B56E92ED4C316E50035CF1AAEDAB080CDBB393D3F16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 fd5afe3244708e913f255f232f24083b955340909dc26e575a05a8971694e92a
MD5 12d6b296e99a17ddd4b160d18f51864b
SHA1 a0fdb5f7c4f1e54a6a8dbfcbf9fde8a109ecb653
SHA512 5256da426c0a5a26bce19cdbb5364a024f554b30c9fd95d11a5fc9d31a4ab009da42383de9263ebc9324ccdc42a42eaebce38cc69c51ed5b40b53e1a18eaaa88
MD5 SHA1 SHA512