a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b.exe
Size 11.5MB
Sample260528-httf9sht2q
SHA256 a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b
MD5 5f1e58eb1a7c0665c92c457183b85f54
SHA1 d4d73058b4237a5443343e1c6bbdc4f90e24307b
SHA512 e31c17fc879ad0474c1f5e96dc211668fc2571bdddbe34394358fd5489c731a0a970110c88d9ab76f7fafcce5198a09b8ca7c4b595ce19e5cd8f972580d12c5b
SSDEEP 196608:QGxzcCaVKlbZnyNRtw5YNTx9Pe20/aVHkiu6E:QOzcvVKlbgbO5mdCahkie
TLSH
T1D2C6D086DB813129DD2A6A70153C3DAFD619BEC91B700BCB96E57C940570BC3193AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5132	a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b.exe

C:\Users\Admin\AppData\Local\Temp\a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b.exe
"C:\Users\Admin\AppData\Local\Temp\a63f88ae1b621b6992f92e5b08b8703495fd379e6eb3eed758defd724e8aa64b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 5638dce69e4177f9318bc4e71f149b59ee97642874d2d7afa71be44c6a5acf94
MD5 f04570e042d78608b34807ea3e69b8c1
SHA1 24722653c8320426cc2a873141bf6c86966e6a2b
SHA512 e6084adc353f02adefb1790668909d071468d9e6dab07fb89c660e0b13520c696187ffd3becc1201210a5ac18e2a559a855c6ee27f0581ba88141aaadf5c19dc
TLSH
T1B55137407FF2BA352659D519B3742EE3CE4A7087A85C46F1EADE570098827206CBE3DD
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 61f4f0ad52f538ff490ed28c7eb78b90505298788e467eb330be9568e094a9a1
MD5 82c1502bbdf63ae8062670b0765b3d26
SHA1 f88ab3f815e53e4bb75b744451ba71c0f849be3a
SHA512 defdfbf4b087710be9d67888615e67545676925b39fc90f3a20f6ec3ab8695321f003c728f2d3dfd71214970e17ac0c943352193ae6cc4743fc0949f68c742a9
SSDEEP 192:h/YUy/FgG399kXTJk9gG39+kXmJAScx7cSNMHNU:Vy/FgG399kXTJCgG39+kXmJAScx7cSN3
TLSH
T11A023F403AB2BA352529A598F37D3EA39E8A7047945844F1E9CE97009CD27246C7F3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 22f90fc46a43f7adbd852d5d2414b9f055a36e7199a04158668b852d2e5ce376
MD5 471a7dece2a845f301862a637f024ade
SHA1 ff303c504a4150790cb3012810c67f1baee66154
SHA512 d94c3bbce59bc5ac6a8c715f53cec7791d3b8fa9d71b128210695c80bf3d4534c282519fd205d3e68c2b0505142d573f5d24dc0a79289e966b58c24c9a528a76
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads