13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3

Analysis

max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3.exe
Size 10.3MB
Sample260601-n29fcaav7x
SHA256 13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3
MD5 fbfdf18b9bebe5552e98e7e75db1134b
SHA1 445cac6ed1af7f5cd90baf195d9c8073619d4eac
SHA512 d02e9e5cd532dbf1bf340c607866223376ac77a664d0108dbd49487cc2038c1f7166cdd3bee48b4a3ca2bdb45bd7de44a472ae71a236bb36a68a5effa15945be
SSDEEP 196608:rPbRDhGiY7B3a4NTx9Pe20/aVHTiu6ENEuZ:rjRDbYNqGdCahTieNE
TLSH
T12EB6B096DB823129D9395A31113C3DAB9619BDC50B700BCB97EEBCD405B16D3183AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3724	13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3.exe

C:\Users\Admin\AppData\Local\Temp\13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3.exe
"C:\Users\Admin\AppData\Local\Temp\13da076a1fd794d815fcfa686dc28753a933160dbf0ca1f7b93dcc7de7c8fab3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 4ea52182989f77aba8b27d0d314e259e9b3b6290598aa90ec9397f1ca291b725
MD5 f492444d4b9710e5d731fc26ad1c155e
SHA1 a9c2648bec0a828a4fab628f60dcc5c1979edc21
SHA512 294a00d648259ce5a51b689b1cc6edaa6eb844b9178e699be6e1f3b4f3d7897235d278cb7ec218706c66f38763555756f0680e65ae5a1450a3fd9ed61f61e5ff
SSDEEP 192:9QsQGrd/U0QXf6+HIVc0QXf6uHIVnW1njWx+U:JQGrdc0QXf6+HIVc0QXf6uHIVGjWx+U
TLSH
T1B9029E0038A5DD3436FE55E9F0773D59DC8834596028D8E5ABEF219089E32187EBF1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 187109481ff6d8fd585dfd993388e57f13b5c4d66fa0363748d4cad4368ca3a8
MD5 ec6a6a35bf8c48e562dcd2359d25c946
SHA1 90a4c05c7c7b354c8755389e18206b85a56ffb1a
SHA512 19c90d01075665a2a6ef7a28542d3449555b910c44e73c247dfd74e43e2c6dfc243c295066258b3e0ff047f3fa2eb1b8dda89f31d02492a41baf14b0f62344e8
MD5 SHA1 SHA512