a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d.exe
Size 11.6MB
Sample260511-qsrv2sa19w
SHA256 a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d
MD5 b3cd7c294f91e9fa301638d9c74026da
SHA1 41737a9f4eecc64a9734ab2dabe124c44b155de8
SHA512 a568f07dd13baf8f3127e51f7f8eead31c4000405a85f823403f85d1ed5c1e9bde8f0c85cc2e21eef8fd5d3f471966f504364acbab17c9f3fe65976e26822be3
SSDEEP 196608:IdnwRZenXaHH/uvjEmiZYNTx9Pe20/aVHdiu6E:IJwRQnXsfuvTAmdCahdie
TLSH
T15CC6D096EB813135DE2A6A31153C3DAB8215BDC91B700BCB96EA7C9445717C30D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3632	a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d.exe

C:\Users\Admin\AppData\Local\Temp\a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d.exe
"C:\Users\Admin\AppData\Local\Temp\a442c7a2f9ee11849c4dcde170a9fa2653794cea7a73792fb123bbe211bc112d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 905c158227507382b573bc2f1902f7aad5435766322240b524dd36dcca19097b
MD5 f587b6bf777f0cb750fa33259efad43b
SHA1 41433bbd1c27f5b0375f02769043c9b84c265e43
SHA512 811c09bfed6d57d4eed6089f301c61f5da40c915ea80643a9fa6bd95ba4cd3a3d33089da5e115fb860f1b21c8c5e091b0d8f4cdda2d1f6313ff391c3a1728ded
SSDEEP 96:KedpplOhSAYVTH3HYaHEHgHfSDHE9HEnVHE2HEaHEAHE7HEaHE4HEL8HEMHaHGHP:p3ebYV4gayVpXYpPv+PgayVpkYpavP
TLSH
T17EE17A433DB49D3A269A7655E67B3E909DC9217EB510C892AEEB019048FB9187CFF009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 b42501210cfd5789b0201e682b46a9800b1c4e7f7940200f24c1c7fb5ee03ce8
MD5 4492dae93354c81c9d953a8e3cd0a1fb
SHA1 215f22a69eb9e77b27b1da7122be8b9c1cc1cf22
SHA512 d10fed976615093eb0a6ab8cbcdd77a18ee5d6bef83e4961ea9e0b567c7239bc0cc4307a741172f65bdbff1e1b205c91900ca952f59ec74a5bbf4fedf83e592b
MD5 SHA1 SHA512