2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a.exe
Size 10.5MB
Sample260528-vtmd6shs8s
SHA256 2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a
MD5 5ac5313fdc5c0e381bb5952dc710e3b7
SHA1 4ed77bfb078f29414cf13244ae285c80c33e2dfd
SHA512 bd67c709a84c12f130a866699a06d4913d812f4de2ceed2032b8e05e6b8c6fa0697bb1f4bbdda3873ef7bae0f454910ca0950141ce6b42e512fb488c04f0dbe0
SSDEEP 196608:4GxzcCaVKlbZnyNzYNTx9Pe20/aVHkiu6E:4OzcvVKlbgFmdCahkie
TLSH
T147B6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
40	3828	2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a.exe

C:\Users\Admin\AppData\Local\Temp\2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a.exe
"C:\Users\Admin\AppData\Local\Temp\2041859d81b29c2744e81df22ef5a3a665aaffbb69c80e4effeb6c5424541c8a.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 4b2d88cbdb7ea68b4e68841148efd0172ef63a3b82facfef099a8e12ef5ce18b
MD5 a9d89c8fd195a07e27ce6100bd7603bb
SHA1 1be8915d7fa81669223ab3172915a19673487a19
SHA512 4b8cfc4973cadfc3022bd6c113e333bb9fcdbd67ed300ffdec9211bb3831725eb682c909354028601f83d89ca93f03c44f9f8d331ea4bbdc7c897267ae2d0f7c
TLSH
T1CFE05E217BE80214F5770A3CA973A549A93BB72B6E91CADD0375048D1C31FA2CD3AB1D
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 8d7d45828b722be093dfe073d4079a83d1fb0eeaed77b9d8321ead583cba91e6
MD5 ce15735491514fce8cf89b4f3156923b
SHA1 e3444daa7d6c84279f20357f4b2117647c3c2e18
SHA512 15225d82e065928220873bed8fc3d8fd027bed4b02e8e39d453c494d550a461c6d91c8d98b54adf6692734eea239f790baed8c5d642f6849b8c4805ce98e0681
SSDEEP 96:KxIjdu1EZjHPHXQdPHOH9HJ1HEXHEBVHE0HE0HElHEJHEEHE/HEx8HEeH0HwHoHa:CGdKEZTs0wbbiWLclHLHICPFar6E
TLSH
T1C0E17D103EB285272E7D9657D1792D706D8830A9A15888E1F2CF819ACCD3510BDFF6EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 5606720a56f1a9f21e9698d7d872c2b5f38f62b939a2ae3774b9fb7b7d2ac466
MD5 d3c8d35f3f66435a808d7f44610f7f14
SHA1 fbc4e8875bda750cea168ff08ccaa238976bb62b
SHA512 76dd773652e64c4182860733d24ebc916f07bb8f6ba0cb7cb9b043aab6b6eef79145048407cdc047f113060ad16f900e134152bb1af5fceeba0daef6c30c0dae
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads