3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec.exe
Size 11.5MB
Sample260528-bef43acv4m
SHA256 3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec
MD5 283304e92af06d2e14c9720d9eeafaa9
SHA1 be82f7ab611583613e7bf33ff5c1a477e65d7824
SHA512 18f8611219acf6f749469168e544a7362fcdac0be4797cd670e07f36d57d21b78420ac2387343ecb2a7cd66d502ae40af5f3f196819489ea5045c4131937ba7e
SSDEEP 196608:PGxzcCaVKlbZnyNi/eKlqYNTx9Pe20/aVHkiu6E:POzcvVKlbgsnAmdCahkie
TLSH
T181C6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
52	4952	3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4952	3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec.exe

C:\Users\Admin\AppData\Local\Temp\3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec.exe
"C:\Users\Admin\AppData\Local\Temp\3cfc0b7be8c51934e019fba6141355b9f3075e822704f77f70a797ef5ab84eec.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 6e76e8e4f8a7d0aba6e4c56bf0c21a6af71516ebc8536fdc67e7a6898541cb3e
MD5 df5af2adf92ef23ea2f2697087674b77
SHA1 82281f83abb3b3804dab245e97a2b5ea569a0d26
SHA512 34bdb1be27584c01be47b6af9eaae8be32dbefe17f5a7d0d3c1d24424dfcc95983c6be0297f636233694a61dc2558441f3a8781bf8a8b82d4753b032a46d3965
TLSH
T177418F00BFFB492A3659C60FA2B03ED3DF15B085653646E1A3ED9C8492D352138EE2E5
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 a2bafeb4a445d28999df939469206a6edd11390edd67d1bb39271d7373044ce3
MD5 1a074072b2603ea752ebe98bcc27a3c3
SHA1 b63bcff1ac5d8bb9a885cb9e4796fb9fbdf5abe9
SHA512 b9941871804b43f949b46d1e3a6642a1fb7d0d37c560c7bce776d99a93b8c7bb4211a698a843574e4dd77b576634a7356ca11652660ea8a38c86c2218bd8213a
SSDEEP 192:CEpKNIp4g37tmPVRAhu4g37umPsRFhttSIVrAh4TW:cNIp4g37tmPVRAg4g37umPsRFhttSIVQ
TLSH
T15E120B0036F7892A3627929BF5B53FD39E897059101148E1A1EDD988E9E31107CBF7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 f6eae2f9262f3ed20e3d0a29233d28069301062ff832b2fa504eb54b0ea66658
MD5 56f888aac477c72be68498e29fc03721
SHA1 8d2347d66e7d3a19deb190bf793789b237cdcc55
SHA512 6cef7f0836ea4702332182a9160ef725b6f96d8e5236577ffbc72232c189f6bb5f8da249343ac1da82f9cfe59f465d58db69fe7ccbf6aaa67eb5d3809fe9b90f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads