ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994.exe
Size 10.3MB
Sample260530-rh7desev6x
SHA256 ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994
MD5 c9d878fcec252f792dd9097cf4d453ee
SHA1 81de27abd795c92e459b86d620dbb94202bdbfaa
SHA512 e9a3a29946dc5bfca82dc40be846c26738aebbd084353615f7ecfff65988846be346590660acfcca72b51758dc8257faf04661b56bf4c321f720aca4bc6d324d
SSDEEP 196608:rPbRDhGiY7B3a4NTx9Pe20/aVHTiu6ENEuZ:rjRDbYNqGdCahTieNE
TLSH
T15BB6B096DB823129D9395A31113C3DAB9619BDC50B700BCB97EEBCD405B16D3183AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994.exe

C:\Users\Admin\AppData\Local\Temp\ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994.exe
"C:\Users\Admin\AppData\Local\Temp\ffb41e51f9ed83868b5fac44a8c675a2fdf5253ddf1eabb91e89331fb6ebd994.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 d310a7fe37cabf7d2094a8e89aaae76f586d1b91fcb1fce4e4765dd9ad0f3b58
MD5 d9d8d30134600cf073ad868e49796083
SHA1 1d0a3a7cdd29c8faee9c03e8723a147c1e202aee
SHA512 44f3998873ff8a8930d0c7bdcadaa266280a041f589409d3f3c3f90c5f2d64d2eb4f3085c2e385bf2e1e1443e0f7a878d995a8c8820dc2be1908cbae2dcfcc93
TLSH
T19A41D054FDA7C66563DC861A03614D96CD39B0CEB93A86E933A9069C0AD35321FBF02D
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 7KB
SHA256 68a47391d32c36452a5e8e98fc851b629b2b8d6690fbc1513df6ee56f9565dfc
MD5 aa3c4a90f35137e96106b0eccf15984e
SHA1 dda1e0df77566574e168330eecb808173cffc89f
SHA512 8b5c2d03132ce7ef3e9dd17270e5cdda33204b11a3b871367f381a3722dd0788c74aa54276142b291a63a081dc6199d21ddcfc6ad6eb543f837aa49fb09e2b96
SSDEEP 192:1YvSum+zNlw6fbJzGzwYzaYznYzGzlzrzqzvBzJICKvhuSr90/5Cqgn/w71v2vTe:1ISum+JJSEYmYLYSZ3O1NICKvhuSr903
TLSH
T16CE1CD847C62C672377D53A8D27AAC52AE5D704E682A48D575ED0ECC0EE35252E3F03E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 bfa3c9caa60c01d942bad3ebdef55b955391b71c9d95513a12001ac828d436e9
MD5 f025c11d2ee885b5f9a50b1fcaa32492
SHA1 dad530f8916ea17424131fc933fa6bb5b0dcab04
SHA512 b28271d855185193e70b28898ccc5c9d5f061f4e4574c3f38f5aa9d5f39a4c8253386d424e81405cf6ba708a2a58bc000065b6bd1ec73d6f185a88175e278ae5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads