da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c.exe
Size 10.5MB
Sample260703-rdb2qaav9t
SHA256 da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c
MD5 1299f4fbb02f1c3a3d67f64326e6079c
SHA1 079f7395c8a8bd4a3470e2b38a628b6373108f49
SHA512 8650c197e300501649e810792336488e821048c5e24d3e8a924f822c6c5b9322d41e43e1902a116fd3ebce994ad01869d28d09f001f89a9f0728e103ff6c06b1
SSDEEP 196608:4GxzcCaVKlbZnyNzYNTx9Pe20/aVHkiu6E:4OzcvVKlbgFmdCahkie
TLSH
T111B6C087DB823125DD295A71153C7CAB8619BDC90B704BCBA6FA7CA405707C31D3AB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	4752	da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4752	da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c.exe

C:\Users\Admin\AppData\Local\Temp\da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c.exe
"C:\Users\Admin\AppData\Local\Temp\da83c1e065b52fb650f07a6b0f4d3dc4bf04bc179f9eac0d7a1ba95422fc560c.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 5KB
SHA256 9406e925b1d8152f246f303173cdb3010eaad290057f72b1168ade1ec18a61a0
MD5 3d0135d1002086bbfab843dbeb9a5b85
SHA1 03c5337208f2d1e1d0346b9bd8d6ed3f575b5f7e
SHA512 0b3bb0891ddb43a162b9f60d26b10fc36a632103cd10e5c65e1e535d5457160c7650924f23b0dda22eb3db43a55f0f6633f3fd085b0983e080b505f9a2efd01b
SSDEEP 96:KRB6IBFBNBrB3lBl7syB8Bz1Bl1BA1B8BsHIBbHzBsBOmB22BOB1PHiB4HHBWHUQ:CB6IBFBNBrB1BVbB8Bz1Bl1BA1B8B9BY
TLSH
T12EC18D00BF76CD6816396297B1B76DA3CDCAE4A560109EF3B3C993D09AC2102AC7F4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 334a5abcd39ccca642d9f158db8fa54cd2255d8df1ffdf2af7c944bb34521b54
MD5 81a4afa089a00500eab7dbaa67b952dd
SHA1 9204227c855beccdcd4807ded92ab79839df5d5c
SHA512 52c468250191d6546631a206b9a31134edfccc89eee88549d1e43260e06f9bd793bfe4860e6962b460b538192d9fd375cbb21bf2eb11ce1716bd07c0d65de39e
MD5 SHA1 SHA512