639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48.exe
Size 11.5MB
Sample260528-dc3amaes5l
SHA256 639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48
MD5 b3436d32226d28a869dc979383444aea
SHA1 b24dc3ea328654cbf3445c360401293584039b17
SHA512 000d55c8f2b15cc8db50aeb80e349f6b220f34d9332bbeb1f230160aaae7e7734fd60c22c941525f1b3eb9afc5ec8ce84737aded0b5457498f569f87c0f2a4be
SSDEEP 196608:QGxzcCaVKlbZnyNRtw5YNTx9Pe20/aVHkiu6E:QOzcvVKlbgbO5mdCahkie
TLSH
T12DC6D086DB813129DD2A6A70153C3DAFD619BEC91B700BCB96E57C940570BC3193AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
812	639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48.exe

C:\Users\Admin\AppData\Local\Temp\639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48.exe
"C:\Users\Admin\AppData\Local\Temp\639ddeb460da506ed55e4916979e1e0878cb5a77a09cc58b29b8d88b75755d48.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 f066b6873874f68d9971d353b09f51d7e6d65f3420f11ce4c318a307bf8ffd2b
MD5 67f715936b4d6de1887d5d228a930430
SHA1 2517a7d8793e9762d09f3e3426dd6ebf52e64a34
SHA512 5482341200a922d859727fd5aa4bbd0c4124c05d30879d603323b71050c088f7e96dfb0de9cf3fb18b774c6823a6f2580ac7eeb8974a0be92988dd5c9cd6b534
SSDEEP 192:DdF36THV0M8zeQ+FTHV0Mzzel+IHV0MzTel+S:/36THV0M8zeQ+NHV0Mzzel+IHV0MzTeX
TLSH
T1EB0299417CF6AD6B1717879CD67D2FD0EC98A20A184098D1E1DDCA0C8DEA5082D7EADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 ef1d0e0ffa77728f9127fb272ba2eebf6bd7ec39cc71fc870ac4b5e47cb7b671
MD5 e44b051a6ab753f85b1dcde5e7e96d31
SHA1 ed2b9d995cd4447b9fd9361a96e5cb695e8d3849
SHA512 985cc9f8643e2c8f6ca7aedef1eb0450f49ec0cd2c700a6742dc858a48044fbe6a03bf20e1c0cff814c9d26e5436bec6c9bb610b3348be428686b7335f066b5e
SSDEEP 192:DdF36THV0M8zeQ+FTHV0Mzzel+IHV0MzTel+cJU:/36THV0M8zeQ+NHV0Mzzel+IHV0MzTeI
TLSH
T1001289417CF6AD6B1717879CD67D2FD0EC98A20A184098D1E1DDCA0C8DE65082D7EADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 b04edd64ce11e522d82bd98eaa2a991b7405920a7557bfe52e9bc21245131c15
MD5 48bec4b68394eb94b0066ec4279b0c37
SHA1 bb9a84fe6cd3fa60fafc76ea24c0b7204415c768
SHA512 930d3a8adcb25358a65eafaaea8acd77d190275591c59469e4e90e721bea80aec02c43d93a0b515076793b64a51e26ff6583fabfd067a9cd841afda1d6376df7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads