Analysis
- max time kernel
148s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe
- Size 10.5MB
- Sample260511-ntdzgagx21
- SHA256 a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd
- MD5 eba240c70bfa6136339184045891a6c1
- SHA1 50c8f49a8a147a06b3168ee990e6fe2974f461d1
- SHA512 92754d3b11a6b6b3e23b528b093ce73b82a6215e546859d9e6aaf6e19c2fed07be472a5752642d3ec50616887b47369da80561a9a85fe5b6c43c15d30ebb2075
- SSDEEP 98304:V6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww7:qdnwRZenXaHH1YNTx9Pe20/aVHdiu6E
- TLSH T184B6CF96EB813125DE2E6A31153C3CAB8215BDC91B700BCB96EA7C9445717C31D3AF8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4652 a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe"C:\Users\Admin\AppData\Local\Temp\a303020a925d05ddae70db7385d9b3f3aecfd078a5f1f5a221ea9293764badfd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
- Size 2KB
- SHA256 4fd65bf6cd19e314a7ce38c90fcf3068573616087e4003ac14ddddea0b4a191c
- MD5 765ba3a07a3f3dcbfdb7f404f085b746
- SHA1 b42c56b256de222630e29fd82b94f52b50889a79
- SHA512 c0fe441eda02db02307b81f2020978adc9a66d12e33adb00a1812521b3bb642beafb8a70b78fc44cf0e0e955574241d6602b528f59efc47fa7d03e07162e8cb2
- TLSH T19351EF01BFE509251389887BA3704F82DE3D7299B9298DF5BBB6150C81C3C3579BE66C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
- Size 6KB
- SHA256 7f896a8f58d6515dfdffdd6e6aeb97b3915b3865c4d46fdbbd0893d26e2ad9a5
- MD5 d420d43ffcd3467d2e615ae9b11556ce
- SHA1 61cceafb7a724104aa7e40ee103938df317bfe9f
- SHA512 bcee8ac64c72dd685630886754d64fb576eb7e01affac58ade0c778ff3717af810988f06220d50360e3ee659edc2244648bf7c972ef78b6369a555065d87c476
- SSDEEP 192:EWUQaexL2a1grzI2/5qf6tgrzI2/B/4RW:baexL2xrzI2/5qf6erzI2/B/4RW
- TLSH T1CDE1CF013AA08936165741F5F2756E526D9D322E74088CF1BBFF190888E3D25BD3F6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Yandex\ui
- Size 38B
- SHA256 7e7ce2082b3d32ee459ee3f850fb0d18dd0fe3b7a73e79ecb2957977562f4ee2
- MD5 55768da9219eafd125ec044a302004c3
- SHA1 abfe567ef8e8fb0c7107197f47b1d38e80f1aeef
- SHA512 9ac41852c463d446ee974057d4c6df564879ad07c1ea4ab86818a4c08707b86ffd83ffdbec3528d6d1fa920b07b88605fb993e441a058513fe0658b0b7ae30d1
- MD5 SHA1 SHA512