9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3.exe
Size 11.4MB
Sample260601-walh7sdv3l
SHA256 9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3
MD5 85e0c3c7f3ebd57300cf074e0f551d8c
SHA1 623670d6fbc667d9777f5cf95df0036b03043ce1
SHA512 4e6138cfded3ed2af81ecbb593ac0f0b74cb2185df07a6d6480dcd7437ef8d6d3f4701fdd9acece1353490d9a2aaae1aab4b412f4799dbfc2fbcf4647a38ac57
SSDEEP 196608:8PbRDhGiY7B3VIKRi1m+RXX4NTx9Pe20/aVHTiu6ENEuZ:8jRDbYN2K41m+XGdCahTieNE
TLSH
T198C6C096DB823129D9396A31113C3DAB9619BDC50B700BCB97EEBC9405716D31C3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4576	9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3.exe

C:\Users\Admin\AppData\Local\Temp\9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3.exe
"C:\Users\Admin\AppData\Local\Temp\9fc25ef9c2b455ceef84a17ae71c44e39416a9b86b829c3cc16dab3a15e949d3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 aa6ab1c4b9a294fb1da277c6948e4fc536858259e9654a6bb3b5a3443cf7247e
MD5 705f12587a5889849c0bbff9d257da4b
SHA1 70a60f6186b36c17157145c4f7156ad472d10763
SHA512 6d268f065dbd04d68cad842bc936a056573bd37fe52df18885463e731b0671197b1731bd4c46b930ce5085baefa88bd0c0b706ce210b60db05d62527baa0bc42
SSDEEP 192:bVQAsh3kQr7BujtjuX2m1BAkBajd2m1BAEBajv:1sh3kQr7BujtjO2m1BAkBajd2m1BAEB8
TLSH
T14B024F407FA1DD742A1E51E7E4E53D57AC98B025742A4CE269CD738488E3D08BD3FC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 bc8b8509d26dd1c816b30df0b2ffd7ca78597f4127552502eb370ee6a9d0e3aa
MD5 d64bb80580b35ccaa9a5bd5b75387b49
SHA1 ff44137c81b061b2a93a6246d3fcff435d457065
SHA512 d063707e94986ae1ff959e2ec40e1a169c30926e876584a98be1849155604af8c474de4319e2e49cfd62a8455e446ec3ec208efea6fcfdbe87a6a30a26e187b8
MD5 SHA1 SHA512