4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe

Analysis

max time kernel
148s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe.exe
Size 11.4MB
Sample260529-jjfcbsfs2x
SHA256 4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe
MD5 11dd406be1b3d6861f5bb5859cbdb0ca
SHA1 9fd9e633e4e1edf10dd64d83ed72785861735be3
SHA512 a02830ee60e4ed1953e2b2bfa74cba1af1eb4d4b5e10a67afacb5ecf1a1d7317c8402c118264bd39d2991893692e4e4b8db12d11341f586dde1636ad22fe58a8
SSDEEP 196608:xPbRDhGiY7B3pOfmseN4NTx9Pe20/aVHTiu6ELEuZ:xjRDbYN2eNGdCahTieLE
TLSH
T17AC6C096DB823129D9396A31113C3DAB9619BDC50B700BCB97EEBCD405716D3183AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe.exe

C:\Users\Admin\AppData\Local\Temp\4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe.exe
"C:\Users\Admin\AppData\Local\Temp\4f601860d7223b4bd7bbcd2386738d8670ac63fa28fb3b952b41738639bda4fe.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 9KB
SHA256 4be1a352f7cf40f14679149ff41edc67aa6684d96c0f279e47b57e7e3da3c0c6
MD5 b5549a743011c08c528519921a095dd4
SHA1 8bc0ad62c70924770e2b89a6d9b6a1f6a5ac7f40
SHA512 a6347bf7182263f74991e315422582d589a31a262766253098c47082e6173181bc67cdaf1b8cd630e0a8bc5b74cd49d9bbbfff7808f2437fcaf4136689020083
SSDEEP 192:A9a+bgz65xnyZJ6L6M56O56z56L6U6qYzSJCXTu09a8d7sSWxUA/fqWq0gTFQVyi:OHq/jt8YIbWUyitjt8YXbWhyibjt8YXi
TLSH
T17C124E40BEF5AD2D651685D4FB6D2CB25CDC300D186444E266C9CF881EF2690BE7F1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 0be90631c1b269aa30b5b397431e6b0ebeb286db81dede6947f66e3bcc8ed1a6
MD5 4802aab27bced42a42fd951ff0126b5a
SHA1 513c0d83bbd611473622feab286e1c572b897dd6
SHA512 aca2f09ce44d155343afa6354d2c27b5a311be72e2154513a682daed3262ecffcf4711da991436a1601c58dcf82cb97e8d6e1f7dc668da7fd9d7951a273803ad
MD5 SHA1 SHA512