f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4.exe
Size 13.0MB
Sample260529-sd4bmsfz8n
SHA256 f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4
MD5 2f5469bd2044634e4861af0e9caffebf
SHA1 1595fea08fe8338e1d5a6f0ea2f66d6d7c4d1326
SHA512 19e21ee9a2d91162da50d0f9b0d38f248dde082b82c0651a34026b1748961815e39825c07420f75cf20bde732742b4c50d5238b5dc8e4e062b085b476f0e719f
SSDEEP 196608:OPbRDhGiY7B3AT1p0mOT/v4NTx9Pe20/aVHTiu6EYEuZ:OjRDbYNgMjvGdCahTieYE
TLSH
T1C7D6D196DB823129D93A5A31113C3DAB9619BDC50B700BCB97EEBC9445B16C31C36F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
396	f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4.exe

C:\Users\Admin\AppData\Local\Temp\f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4.exe
"C:\Users\Admin\AppData\Local\Temp\f94fe74609db124c975ac3fc4d9be9dcd95379f830cd328bdd9f9557716171a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 4KB
SHA256 711f7f0aca60500b78bb0b5c839de1665b1486a7bc4be519b41a8aff52146116
MD5 d51210f50b59d1ace3dbef85a83274f2
SHA1 1ba67c194e3b901cd16d7d53e05f826370c8b624
SHA512 b3e2c4acc2d4ef062fab15f92869b002de3834757f10f67e0f3724944e52573d5b1cb663debd69b7f7f921044951eefa6bfcec97501096df53b3b3724704e669
SSDEEP 96:KhFyGVb3d0fMIqNSYIknFLMtOtztLdHy2HL76YHEuHH/H2vsHE/OHEOvVHEJ7HEI:kFyGVbt0fMIqNSYIkFLMtOtztLgiulEG
TLSH
T1C7A1AF213EFACD3636D94A4696BB1D668C89B30D70D44CD5F6DA4A200AC3910BDFF1B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 debbaf9ce445ee8ab2693631e03f81f09f29e3bf7cc905b1d76f76d52336a576
MD5 6ffb0fc6915e7b381d0ef6ed121b6438
SHA1 a7ae92ed7fc92264c784c2ad7f9f0287df896a84
SHA512 027404e1392f8cca83185909a3076f682c01551aec60fd4bc1b3b2ae9eec29e7224d38dfb48e08067e0ba800fe4eee877c6c295572899ac8959561ad6d38caa5
MD5 SHA1 SHA512