658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00.exe
Size 11.5MB
Sample260528-ppdnksfw2j
SHA256 658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00
MD5 c1ec0cb987687e53ce79769c13783733
SHA1 454d10e89c86a1b8d8f84d5ee12cf15ec6542aec
SHA512 2883a46b853b83c190c10d82a93cc320fbc8ba0d1686dacf98d54384a384f3cc93b6f408859d41e7b0e2dc786fcb467a6e4ed445ff739ee0d5314dc09f7e2bf4
SSDEEP 196608:QGxzcCaVKlbZnyNRtw5YNTx9Pe20/aVHkiu6E:QOzcvVKlbgbO5mdCahkie
TLSH
T150C6D086DB813129DD2A6A70153C3DAFD619BEC91B700BCB96E57C940570BC3193AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00.exe

C:\Users\Admin\AppData\Local\Temp\658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00.exe
"C:\Users\Admin\AppData\Local\Temp\658cb8ee0d738c9b5ed11fbd3102525bffc45e6d0ba17674397f7cd2249cda00.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 cd099414f22c232ce59fbc31f3fc85f1659ab77c7ae653c1549be26a7b6a65fb
MD5 8ae408c5ba9fc68092b97b873cfd80ab
SHA1 4d1371348982827ff434a6096cef0611d2453441
SHA512 34bd27ea4aea2eb9386efc6f80a66dd60b1d891d6643610ea5ea44cfca171d45492799569a57a23b84ab516cbf119b12402a01ec7b063071a18e6ff2da344a04
SSDEEP 192:LnCtiPhzf8m41m+CLXzf8mH1mPC6zf89sot2vW:etiPhzf8m41m+CLzf8mH1mPC6zf89soP
TLSH
T1AB02AE427DB3C931362F8574F7672E50AE892055315C88E139ED82843DE6128FC7FAAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 8046275e2a17703f84ae848182771c1f0ef781a074f831d00bbe2f4816c396ac
MD5 9efefff83eb8ab4cc4c8f21480c06e25
SHA1 a183f090a3274d3056eeca4839e3496436fa336d
SHA512 1daaad8ac21960297523ea1cfb6b7e09b48a60bd331bdd02c7f8a00c542057dafae179be84943e264af55d1cb4aeddce81c7e601e588fcf97e6eb654760c936a
MD5 SHA1 SHA512