42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276.exe
Size 11.5MB
Sample260528-bdfrxaev3w
SHA256 42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276
MD5 a68edd3a2a7ffd394d83593e35373510
SHA1 95c46b01bc65dce4de8a32da1f397dd943b53444
SHA512 d46e070b4d35067f44ca28bfe7f1a3f162070c30aa60ebc8f0f2110a9a81871bf63905fb42ce785d085a7cc859c13903cd393b13b74dc69bcdf0da8cbd601768
SSDEEP 196608:PGxzcCaVKlbZnyNi/eKlqYNTx9Pe20/aVHkiu6E:POzcvVKlbgsnAmdCahkie
TLSH
T151C6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
428	42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276.exe

C:\Users\Admin\AppData\Local\Temp\42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276.exe
"C:\Users\Admin\AppData\Local\Temp\42e542a78d03c0d476f68ff6d64e7372badcd8b90b2f817125bca70714283276.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 1KB
SHA256 4ce51145449461cd261a993c2e8f40ea0d0eafae154bcbdb4cfd455b40d6e9b6
MD5 ece68be3249b4d6916646d7acb008667
SHA1 c1a17b53445299064bf87fd164138844b76c4fc5
SHA512 d3f39a9ec136fdf941bf9a49abc845b8c8e92a614d98ab7e09d15be0cdf87819f8687f21935ff7409f9fc76d933c0411139e46d6a33afcae5d10d923d7948366
TLSH
T12241DD047FF3496A2ACC814BB1A25ED3CF18724FF12851D1E3ED495641C382A3DAE2B4
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 3f3b2ff15cf366891548c3e0cea9bc13bcef96944d209286b701b8540e0c4a8f
MD5 ca1bd05898e720783c5cdeea0c7bbe58
SHA1 5624651a16c816bb86b275078a339ab6fc0d7df5
SHA512 f3fd5f03546c13cb6ee02a6b0b8c5cc01be9ea0368bb5a5ac4024f166f5852fbb3d040bd914c13b6220850f0ec37c7f6d477fdd38a2d1471aed9e52283e75904
SSDEEP 192:oB1/Cr5QIgJXGC0R7kyroWKFpoE/9TDeU2aE563Z54IgJXGC0R7klroWKFYoE/9c:a/Clo2f1FUPLRuko2f1GUP+RuJo2f1Gm
TLSH
T18812694479B385A626EF41D6F1667ED2AD88310FE02898D5E3CD8D0288D351DBC7F2E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 86191b3b33c18eb961249699635c163e164ea2b5965bcbcb226c3d4e1de274e1
MD5 3594f94f56084558ca1e1f3a4a6b7c1f
SHA1 f8435eecc360cb2ba3face1990414731aea13b7a
SHA512 24a7e222fa1409d1d275e068622355b152ff214c7ebc05f514369bf2b60c5eb458e62fcbd719b7ca206ed3aae1e4a5a7cbeabd47741bc9ebbf5351da6a7ef81e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads