91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa.exe
Size 10.7MB
Sample260528-a77baact3p
SHA256 91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa
MD5 d0c389eb0ad9d430b8d171c67ff1bd82
SHA1 8621f81ad001c37ae98841639d26aeb0eae38ee7
SHA512 d4812320a34f31b7d714e660d839b40a4efc1be1fbbd4b1ea25fb516d0486b17537e4978e7c286a038a0655092497e14e917b7901ba6ec9d7c125b262f2a30dd
SSDEEP 196608:LCwjJ3MovS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:LNjJ39vRrDjtLKkOa8ps6puAktIz
TLSH
T1DCB6E125FBC69305EB262634157D7D3B47217AC40BF84ACB92636C881575BE24C33EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa.exe

C:\Users\Admin\AppData\Local\Temp\91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa.exe
"C:\Users\Admin\AppData\Local\Temp\91a6209e0d080f1d11fc20631dc2f474d9d76c5c57630357284cb7762fe34eaa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 16KB
SHA256 b91c83c6c9fb9fa0f281cc4a8ab670cd1dfdd9bece3fb4c3ba320f1fd66ca34d
MD5 3e666e7c3d0bf6ceba892fd8388d95d6
SHA1 f38f304ee130eae38a83a994e24ca95e2a6a082d
SHA512 878d6fe819f9bde22eab3927cf73524129a51b7da8e4b17448e95ee43849091ada92a8ead09fb103f1d02b2b6ddca65e48bad50d360c4f1a7b0ae3d0225bd941
SSDEEP 96:KkOIRgS+D0HiH3PHqHiHKKHUHcVHjH1HTHGHFHlHx8HOH4HUHnHFdbPHqHiHKKHU:jOuL+DSt907m+evorP
TLSH
T199722D8979F64C373B1992A5CFE67CE19E44F097693416A0B2DE804419E36243DFE2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 f2cf1ae7f28b8a43a31795f06c86c3cd8a430c20803a5408ae8750f24c2d573d
MD5 94f125fba882f75755619ecd2dedc246
SHA1 0d8513265f6aba13b4eff00bd86cb0c8e63496ea
SHA512 292297b83be17142244ebf0f70cbb4c7ecacdc84f88fc6b500d031ba74ddf70a75ad116da6d5f4083c075587f3f3eb756042e53d5decf3be48d95a756766bdcc
MD5 SHA1 SHA512