73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa.exe
Size 10.4MB
Sample260703-ms1leafw2v
SHA256 73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa
MD5 96d3ceadec008013caf820d166652ef3
SHA1 cc5fabd059e9cae277b1dc009019e175f9b2e93f
SHA512 84cc1bddb9054ccac8269eca5f994cafb432aaa2ff23ff0e4cc896cadd250bd8afad5e56a995d1ea3510d46941943283b897d0d63cb3e23a0a0f9bfbb851b931
SSDEEP 196608:eZyhPtNAbOy3wSVLNTx9Pe20/aVHXiu6E:eZ+PtNAH3wSVZdCahXie
TLSH
T194B6BF46EBC22125EE2A6E30593C7DAB4719BDC947F047CBB6E9385414716C33836B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	3800	73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3800	73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa.exe

C:\Users\Admin\AppData\Local\Temp\73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa.exe
"C:\Users\Admin\AppData\Local\Temp\73170bb2172fb4a3f0836b092648afb6a6c755429f5c33408779b80017534faa.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 1KB
SHA256 9d7eb9c20550f05c5f0ef97397f2651a9a8e00f3e01fecb239bbac59a428fa86
MD5 879256839600355d2a9305fd9c4c9900
SHA1 e52cf1dbd37792c3944135adce2eb2eb2856495e
SHA512 e0348d4191ae8ef28f6a5249aaaade21ae67fe875dcf34b230bb6291fcb8439f00a4202b106b02a4264e12f397183281c95dcda054d6893d6cbd43d421bb0e60
TLSH
T17B31CD01BDB5DA2823E8834F71711E95CDAEF441B45507A9F7AB4ED013461026D6F5D8
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 bb64d4af7a9595df58d887a8791baa34b4e4185a38ab78c063524bdde45cd8c0
MD5 b1cc1b9b8f5d6d2166e47f665e25734a
SHA1 0706f1a66479bc9b017b0f4c58cc3d3aeacd5f8d
SHA512 b01e72f618bce8f15d329a86c6092429f56a78ab69f91a40dcc0d0470b6c7688f1ae1b51d5dc1fa1971b3fd8f3836ac68d37b26aac6ae50cfbbfcd494c349735
SSDEEP 192:CIpeVj3wc2e1s1h12GgrLiyNDd8Lwrf0qh1oHWI9vo8gpFuEwDe8Lwrf0qh9oHWI:7WSf/gd3VwgD/VVPS6L1U
TLSH
T13E029C417876CA38267A53AEF17A3D66CCEEF404704559E4B2CE4E805ACA202BC7F5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 541899e0caa7c896aa3a9e13bee4b48e217b8039bc4dd612cf12d463529cbc3b
MD5 43b95bfc22ff0d04b7c493e1ab3a434b
SHA1 6f83126994ffa7f0eaf826806d58baf18e808e28
SHA512 58d1517d5d51c430a808ffca4a77a0e3cf0b2e118de67c7adeb14fedb939f3dcb8c985d709506c3719d206c1fa924b8d5dadbf09ca008fc3f77eecb23b3cea1c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads