49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb

Analysis

max time kernel
148s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb.exe
Size 11.4MB
Sample260531-m2fmlaez9z
SHA256 49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb
MD5 52715303c40a972a76d818728d3f6324
SHA1 c3345614e1e2e65899cbb0b164aefb1477209d21
SHA512 a9487e242b0da20e6ac89a633f935977416d6876c3951f96df71523703ee2bbf3666c42e4af86b5c223e34a8a7a3e4a8c1d681d191bc789dc5e501aeecaca71c
SSDEEP 196608:8PbRDhGiY7B3VIKRi1m+RXX4NTx9Pe20/aVHTiu6ENEuZ:8jRDbYN2K41m+XGdCahTieNE
TLSH
T1F8C6C096DB823129D9396A31113C3DAB9619BDC50B700BCB97EEBC9405716D31C3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5184	49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb.exe

C:\Users\Admin\AppData\Local\Temp\49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb.exe
"C:\Users\Admin\AppData\Local\Temp\49e6450d13833d899d68e8bb8d3380409cf0a10d52b1e56a5edce8841123f9cb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 1KB
SHA256 59d798608ecb7e9629cc123a208de9abbb78258b2ff7e97a69c435187fa7c79c
MD5 4281c4b6276756700bfdce73e3a25bc2
SHA1 cea4dcf05e37e6853d1a63bbd5a12104180dadbb
SHA512 85a129a37b87c047ee5ae6788fc51916a7d4c14e8900e006dddfe850a31219f8d13497327702fed593c4ccb9b5f7fced56875152ddb128077ce301545d81722d
TLSH
T13931C258FDA1CD6AABE8E14B30720D5ACC6D78C3E91547EB37FD005006C382628BF129
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 9KB
SHA256 8d72816e35b80de938d6ca85cd6fa0cfa059b20fd395ef517d2265e0c1f25221
MD5 e1d60db1da84909718b4ab5192917f3f
SHA1 78b5ec3743201f55a90cc6c41cdda452858f3056
SHA512 08e8e7b69133375aeea3fe4904811b3df0d4d51f67cec4bb629628e8a0c2809131883eb1f44aa2cfaf57b88bf556112ad44fe1aef79d74f0ba781b2e14e19e11
SSDEEP 192:08fQ4hZVQ1N9SwCbwc4RLN9Sw1bwp4jN9Sw1rwp4rgPdBY3uuU:N9VQ1N9SwCbwc4pN9Sw1bwp4jN9Sw1r8
TLSH
T1AE22AB947CA2C93AABB972ABF06B2C568CDD388BD40548DB79FD041009D352A3C7F15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 50df7a6fb7ce0c30880f295e6d91c68e7133e7430aa2262136ef1582d982e41c
MD5 9236aed5849d1c44010d9e586c398f32
SHA1 748e539fe0e9b670b2885d63c846726388909bec
SHA512 b64bea2e5ff3041bc886d288ebe1068910c8e36d8a6d4315685d0826a12f32b03b44474e08fc7e765483163258d07434bcba801f9e85fa71f3a2cf5cdec113ef
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads