ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4

Analysis

max time kernel
148s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4.exe
Size 10.3MB
Sample260531-xkrnmsgx5p
SHA256 ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4
MD5 66fb02d665baf89afa64913a87fae51c
SHA1 26390163e01d29d137da5f57d17fe40c6c5c90ca
SHA512 58ff72ab57fbac6c71baf20711d6b09fd58b163201ad9d785924de1913492a54c3faeccf555ee829c70326213f37dddcf2c2d1c8993db33cc8fd154e5fabfde0
SSDEEP 196608:rPbRDhGiY7B3a4NTx9Pe20/aVHTiu6ENEuZ:rjRDbYNqGdCahTieNE
TLSH
T18FB6B096DB823129D9395A31113C3DAB9619BDC50B700BCB97EEBCD405B16D3183AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3992	ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4.exe

C:\Users\Admin\AppData\Local\Temp\ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4.exe
"C:\Users\Admin\AppData\Local\Temp\ae31081e0fa2767c97ae043036ae9010cdaef66f1c2ef1b920367a12311037c4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 cd3ad920b304c5cef6ff3f7ddc4e8d547abb42fdb2fa21c7666d776f800cca02
MD5 efad2d182c80f0b31189ece4aa4088c0
SHA1 8369e5b004082a0151be5c421e0367969f50d05d
SHA512 342e5d4b31f53b6fc2a79fbffa65d0111645ea6147fbb485c245052340db36097cb4ed477aa6a5932238e57521000ca881c6473526115a9d3aef007c09884b3f
TLSH
T1EC5154127EE54F6E37EC864B52621E5ACD687080B91E4AEA3FF91D520FC15701CFE1A4
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 98d1766628f14026b5766da127b210b53356a940c74c984134631c3e88b8640b
MD5 12a222071c9e9e178fc38cb9699b3bd5
SHA1 7587185bcc678c8114914830bb8d8516e2d77cfe
SHA512 6cb9f9dd4152d6f0880eed0c52ab26761095c49ac48729ebde7624de7eb4c7757e213562260cab7e988b3a6e19c9e9ff4af0159a7533d53fce0782a200111d8a
SSDEEP 192:QNfi9VdojK3xJt5uA1XE5Ist5uA1HE5IzHYgSzOeU:kiDqjK3jt5uA1XE5Ist5uA1HE5IxSzOP
TLSH
T126029B1238A58E3E3BAD96A6E1A62E5B4C8C7404740DC8D67EED1D910FE31747C3F1A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 a6bfb762a3d1f0a50958f1070ac81bb6e75a17cd33876141d895d77465ba1298
MD5 dfa5a57626d66caaeb2358856c21527e
SHA1 ae27923ee20902f9c79ff8407c36e49c69112f7a
SHA512 10d6962ce28b88c2e0426a6a37c82ccd6d383fef00a94d20e02dd661f17d084781d748444b134ea96cee207aa35bb4bcdf5d11e214cf39abaa66311ec7d2d311
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads