a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560.exe
Size 10.5MB
Sample260529-epdcpscx5t
SHA256 a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560
MD5 3624cb2f6d1235903606285c52d55188
SHA1 adea033cc7446067789a1fa583dc4128eb59039e
SHA512 c7475724df72172de4f14dee77f0234ae700d4fbd5668798bf5ab99c637d628b88d540f5c256cdfe2825c5571968b72e90e982914cafa6412587a41e1575f2b2
SSDEEP 196608:rGxzcCaVKlbZnyNRYNTx9Pe20/aVHkiu6E:rOzcvVKlbgPmdCahkie
TLSH
T115B6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1308	a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560.exe

C:\Users\Admin\AppData\Local\Temp\a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560.exe
"C:\Users\Admin\AppData\Local\Temp\a3ee1d76b41c148808a02e580feebc4863e9c6f2979cd01ddb1ad5b334287560.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 7KB
SHA256 3f3afe975317bc9206883f22815f50971cfc792fa8ce98942ec6b87de623b40f
MD5 7477169cd1d4044f3c0011d0ac639a71
SHA1 1805011ff6a1d0a9bebfe053c269e0e86335a1e2
SHA512 93e09bf7a5cd118af550b6ba955e472e97936f978d94656d753a2a76553095b5c6f87d4f641d73cfbec249229c16426923418f8681df372861a62f36508138e5
SSDEEP 192:fy91dOzJQOUnTyyHV9oMUnTyyHV9xFNPTmBoU:CLOzGOUnTyyHV9oMUnTyyHV91TmBoU
TLSH
T177F16C007FB9C9371E19C6B9EA693FD25C49B0496044C8E466CDC284E9F23963E7F399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 df5b0c6a7abd7cb33855e28f153c789e5fe24b02a8cb1d0664686341a620a4aa
MD5 19459bfbd15b9b63ec4e5728b5c4fa25
SHA1 3c986a43a5846f1bb38bbdb19c6c35a3200ff344
SHA512 c82267a53aeff834c24be5a0cac8b032586af859206465a739caa1d6ab0662b677a2eca0d689156eb0e635a2bf70576f1a8ce0e56d47f70a918855110472ec9d
MD5 SHA1 SHA512