af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a.exe
Size 11.5MB
Sample260529-gpgfgady2s
SHA256 af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a
MD5 b76fbede41c6fe94c26721c89c85f08b
SHA1 33da8b473b9aed808d5a03826c99594137cef08a
SHA512 0914f8d4083408e7aeb0f7615dfd17f72822d1f32d1ce4edb9750b0069d86d4509bcffeb383cfc5de00fe3982763286f78398f662259d880a79ae8011469efdf
SSDEEP 196608:EGxzcCaVKlbZnyNIXFe1xYNTx9Pe20/aVHkiu6E:EOzcvVKlbg6Fe/mdCahkie
TLSH
T137C6C087DB813125DD296A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a.exe

C:\Users\Admin\AppData\Local\Temp\af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a.exe
"C:\Users\Admin\AppData\Local\Temp\af1be49a658256964cbbccfda0c7b55c76745e55651b1541269969a23792593a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 9dc8538d12c03c827ae469174752713f91f098b27761b93636aeb867a55a948d
MD5 3981b31b889007e346c760546e7599a0
SHA1 c448799fdb7733a12b41d6c5bb6c9daea8d1494d
SHA512 b5c58929fd1511efedfcf43b48cf812393ce3826cbd376fe833d7482f65aea810ac251e6cafc543d36c243fa286b848b221649a4bb4c7542e355cb0629769077
TLSH
T12041ED00BEF50D79368C8F0B037909D6EC58B05AB67A59A536ED050C73A23686DEF1DC
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 4KB
SHA256 09149c977947b1831fbb402faa2cefe67b73e3679a42a61a8c04ea4fa0e077ba
MD5 dd9cbd62541e20797943df72ee7f544c
SHA1 f559d8622dc3b8627c98c8bdcc943e2e752fb176
SHA512 7288f07cc50940ad12192e3c5e9649cf7a146ea9f421c67931fc68442629a7a1e433807d8b2360081e3288e78325546b35b3d382bfb13d6d896535a958195d3b
SSDEEP 96:KJvvJptw8ZIlDHjHE5HqHzH17HELHENVHEKHEOHEQHEzHE+HE8HEj8HEsHWH6HBg:inJpWAIlkIM5tHw9D3L
TLSH
T17491CA007DF08D29361D9B56936E6C92AC8CB01EB06A589172DD420CBBB235CADFF1DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 4094c38e00923fd6bd86a74a05266ed93c76af757da537f70d420c1a6a1e0444
MD5 385be86fe09393c068df00599bebb6db
SHA1 46d6db92543cbc59cc3503686962bcaae11a597e
SHA512 35aea69219aab8d79f9a7d5af3d03cd2946a64609f7641eef96a7814a5bfa9a80f0ea63eb4dc45f572708b9bb288d9e555c1e883e09233d6cc6691a0afb96e71
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads