0abfbc7afb77481e8b10618bd48b8b337172af54e5ff52a718f4f7c9a41cb7c7

Analysis

user interaction
yes
max time kernel
899s
max time network
497s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stereo fix 2026/Lightcord Stereo FIX.exe
Size 356KB
Sample260620-lezxaad18p
SHA256 0abfbc7afb77481e8b10618bd48b8b337172af54e5ff52a718f4f7c9a41cb7c7
MD5 19b458f1d8c6fbfabf7250426f1298dd
SHA1 10ff0a68ec9aaa4c47bb49ee3081c24e370c45be
SHA512 4589a5219e85ea1e1ceb2240f0d14c90d2009bb4cd3e43b89354998abce76c7f65ff791c03e05586315a6fd956cc838cdae4d30515056efd3b222c58fcd4faeb
SSDEEP 6144:5F5c4V3Q0HZbhAItlCD6BDaFPmqVLaVYpQhHHCi4W06Wo9dypMBfPUikgianN0o:j64ZLHZbhAIt5qPzVLaVYpQHL4W06WhP
TLSH
T1C774AE55F2F050F9D06A9274D1BBAA0BEB363C9D16208B8A33ED15495FF327059FA312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	Lightcord Stereo FIX.exe

C:\Users\Admin\AppData\Local\Temp\stereo fix 2026\Lightcord Stereo FIX.exe
"C:\Users\Admin\AppData\Local\Temp\stereo fix 2026\Lightcord Stereo FIX.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2932

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4320

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4952

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads