29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8.exe
Size 11.4MB
Sample260529-hdphdad19m
SHA256 29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8
MD5 d2e74151eb1c05f62cf2e18a8448827c
SHA1 3f7401667eb93dc58f9ead178d2366634846ed63
SHA512 2f4a7b48b979bd4c551ebb913622b58e1ac2f0d1eac097d2dc444fb17530b463c1bce7f83de2ce05caf093b0a802973a589860e8e42c30bef80beb4f3858e9d4
SSDEEP 196608:7PbRDhGiY7B3pxYpLIAd4NTx9Pe20/aVHTiu6EdEuZ:7jRDbYNTYpsqGdCahTiedE
TLSH
T14AC6C096DB823129D93A6A31113C3DAB9619BDC50B700BCB97EEBC9405716D31C36F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8.exe

C:\Users\Admin\AppData\Local\Temp\29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8.exe
"C:\Users\Admin\AppData\Local\Temp\29d56a7070cfe79335d545da937de3cf844f556a4602d6e74ac124f9f3dea2a8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 17KB
SHA256 696f1b22ed47e17f6a64b38618a935a129ab6228a201ebcd34e6066aeb80a66c
MD5 317baa09d91dc4c69834de6968c40cd2
SHA1 a53e97f29ca8533c2f7f784ec64eabf8bf8d053c
SHA512 21bd8cc32a9b41689d22be9dad44f118b4e9129a7913f604c08bdf820c0bf9ef9c2601bbcc41cd4fb549dcd4c75e17b1dd2fc90ec4fed48ad138bb9735378e16
SSDEEP 384:/aWO2x0+Jl+IOjUUMuJl+I5jUhMsL/wy/tyLagfCF3eWoKa:/aWzeAa
TLSH
T14982BC893EF67E3B3BAC529AE76D1DE08C847185205885F036DA824065F76703CBF59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 88d2972de31888d1735d170a90267d227cf2559d4dec786acc6d091d89e0b962
MD5 948ddf7aeb84881203822dddda3ab8c9
SHA1 1fa77585886f899def8c066c61007a1f863fc8b3
SHA512 537e0cf956b5a0ebb0b33dfba32c95f3947caa6955c1e13f1594f47ec8f04cbc5d4708eed2cceac7524aed53513ed1971ad3785961e97e4023c5d1957e211f99
MD5 SHA1 SHA512