3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72.exe
Size 11.5MB
Sample260528-htm99aht2p
SHA256 3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72
MD5 a74068bdc6a1cd6942f9c2e48564aecf
SHA1 18508f57f7ae8c88c994fa5f61119354b826528d
SHA512 e38bdd6d103b0a84a6478d3f0061962c132dc056a9f34cdeba3a449a1b5a9839b41a5cbe9a8876a65f2b75b3c61611951f048bcdc62da7635a1135a021ca7fd6
SSDEEP 196608:cGxzcCaVKlbZnyNoQ2bYNTx9Pe20/aVHkiu6E:cOzcvVKlbgJ0mdCahkie
TLSH
T10BC6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72.exe

C:\Users\Admin\AppData\Local\Temp\3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72.exe
"C:\Users\Admin\AppData\Local\Temp\3c0af3ccccd81db29a15a684720e70ffb7dee9fca215376ce3b02cd7d7d87f72.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 10KB
SHA256 365289d496e633ff5e0840fc92d3e68e96f25d4e9f0af64bac1fe2df0c7945b5
MD5 724c1e9ba7d18f8ba8533e91c93b4a29
SHA1 c0be6a74213d1917546fc182133e490655bb3a0a
SHA512 8de78061917c9d7a46c0e14c6fff750fe78945cca408bee6060f88e25a839ec7a67a65aabcd2973662c59e5ee3fafea4afc9964644ca3bb3f070cf5e6b5af5fe
SSDEEP 192:FPtZwxD9qNIDMgXXRGf594kMgXXKGfo9wIczbmqL0BLqaOMZQBU:MqNIDMgXXRGf59XMgXXKGfo9wIczbmqU
TLSH
T16F226B443DBB8D3F27198698D1762FE3AD58344E504468A2B6DFC600C8DA5307EBE6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 0ea1f8f80ffa1f78bcc75ca908aa7c135274b2b6307fc22dffbd284f854aa7a3
MD5 24e3881874ad45f29fd6a49d793df345
SHA1 d74fcc347f0dab772be44939e493fe15cc293ed4
SHA512 951b4c59299820bf9d034491dcab266492b040622bb23017c68cc5095f826df078818a86a6a95a50899fbf35d45a7cd76fe0a87e1f5430ad8f5257ef9fca9f04
MD5 SHA1 SHA512