4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887.exe
Size 12.1MB
Sample260714-bv3yrset5y
SHA256 4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887
MD5 147b8809f1567bd3009494ed9d066af3
SHA1 6bdaef74374c4f5154f6cb3105e6e22ae1aa8e2d
SHA512 258355b0b950d0cef96cacc332d68a84df41ced89415d59b45fa4f271b496d3f5fb994a717b341ddd70e6ffd7c8308912d326b246c687f4088f342421527c73a
SSDEEP 196608:UZjJ2kPQI079uC1CNuNxi7YOeNlA7W38NDaW8NR:UVJ2C0U1NCobenAE4Da
TLSH
T122D6D0579B863229DE3A6A71113C7DAB9619BCC50B700BCB97DA7CA44570BC31C3638E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887.exe

C:\Users\Admin\AppData\Local\Temp\4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887.exe
"C:\Users\Admin\AppData\Local\Temp\4e1a787bbaade956ec3ab494530786da70bac10aaee1be48c0d7e2bb94f6d887.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 10KB
SHA256 db13bfe81c5315c4cb1a8518c94dd6ea535ffcd11f2f53343736757fc39c3ac6
MD5 73f5c9bce1c16f2f7748213b66798d02
SHA1 21ff4e54b5fe5b54874665970a3ff9603386eafb
SHA512 c3d637536f9763ee40df1c5338fa871847f07f30341ee20a1e6fa599ba1b34a5d1d599bacec552fc03febed9a7c30fa1c1b760f6d27300c866fb0cd70654d559
SSDEEP 192:sbnwoqBdVQfir8pQJ+qiNFX/Idzl6v2TQwVAkAxalB/T2n6fU:toqHVQfir8pQJ+qivX/Idzl6v2TQwVAh
TLSH
T1B6228B0B3DA6DD2836155194F0AA3F50ADD8F01F751DA4E2A9CF88501FE2D6A7C3F06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 7821fcc8a51347d7005e8e848f33a4b59d16ebdc39f1487991cb170d7866c6bf
MD5 ea1b4dd6efe6ff4edec05d72e6edf7d1
SHA1 7214f7bdc2dcaac5d13d55a6d5d48f8b54fcd69b
SHA512 cfedadf849a56a47bee8b813c3f062bf7f5bc99a765e9c333a71f7a5f1babfc711c5a16adff579e08f62df9969a8150d3451b0d129a053c5edda0b2ec0831c6d
MD5 SHA1 SHA512