7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04.exe
Size 10.5MB
Sample260528-bdws5aev4t
SHA256 7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04
MD5 9057d1203143eed6d14f8050718780a8
SHA1 092840d6890dd04c4867eb7a7b8434e824ee3839
SHA512 67c271fdd8c3e4812a9d6350aff7ad2333a85eefe929147f12348e029c62ae381e51c232038c61a30d62ae10ade652b50a358dac4837c7f26d52b26b3a932dc3
SSDEEP 196608:4GxzcCaVKlbZnyNzYNTx9Pe20/aVHkiu6E:4OzcvVKlbgFmdCahkie
TLSH
T1CBB6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1808	7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04.exe

C:\Users\Admin\AppData\Local\Temp\7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04.exe
"C:\Users\Admin\AppData\Local\Temp\7dc0c8c38698d7aef5189e2e980e96e8b175c16fdf0f1f25924de77a4a7b7e04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 de8e5395060e0641385953224a5a913c627994b4c14b0488369bb5ff464816c2
MD5 77368f45e23f60cb023627fb02983dab
SHA1 94fea7bfd8c62ba701671fa32b8551e17af204a3
SHA512 2d91b8899171096860b71f4c8675d55b762f38d72590c8d628f7c981a70c4143f1cdbb68173e8661e16ffad809ab1ad5c2f63768a8a749d4605db26d83312796
SSDEEP 192:xi9o5tBkNQGK1dw4xmzEGK1dwIxmz9W1n/ilHU:m2tBkmGK1dw4xmzEGK1dwIxmzY/ilHU
TLSH
T1BF02BF407FBB893217178554E27A3ED28F98F669B110C8D6A6CE820498C36106DFF3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 e693d2482c01b6a7dfa66a833e898255ac7b6a9b1f112002f12210bc283750b8
MD5 cc7074a9dcc499a8a3eb4c76ce7821d9
SHA1 b8ca75d4b9fa5fa96d50ad42d74663887f72c731
SHA512 f2856bb62b7973cdd31d0818693d5dfbe80dbfb4862df40533fc5cdb3409411c25389e572a4496e48ec1f9561507181e01d01e390a0db192724c97fb66d80057
MD5 SHA1 SHA512