4db4005124ae65d15010199f1f52ae396f72fe7e2e46d5162dce039c0578cfe4

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ASLite2020.1.exe
Size 16.2MB
Sample260720-db8e9afy3x
SHA256 4db4005124ae65d15010199f1f52ae396f72fe7e2e46d5162dce039c0578cfe4
MD5 98b194a597ae2d0378aa7fd581db0863
SHA1 7444b7fc4a9b19fc36120ea594f46f926c4a0f89
SHA512 2b0027aabef5aaf6d7defcff2f3292413854f36489eb9f9da9ba353b398e4c64b8e7655e562f5fd61b18d144dd9965db053c89d27a2281279aa9eb579a09ce0b
SSDEEP 393216:bvjAP+5eznD4bZPPWnSJdlszno3Ra2LAfdG/sK6eDhiofHF7bhV:b7Z+nDOGSJdC2a2LA14f9lpV
TLSH
T11D0733421C3598A8C8D7D47C2C374B51EFDF81BDD986990A230E8CBDC9A7A91DB12B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	GLBEE8C.tmp

Loads dropped DLL 1 IoCs

pid	Process
1996	GLBEE8C.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLBEE8C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASLite2020.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLBEE8C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1996	2112	ASLite2020.1.exe	89

C:\Users\Admin\AppData\Local\Temp\ASLite2020.1.exe
"C:\Users\Admin\AppData\Local\Temp\ASLite2020.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\GLBEE8C.tmp
  C:\Users\Admin\AppData\Local\Temp\GLBEE8C.tmp 6144 C:\Users\Admin\AppData\Local\Temp\ASLITE~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GLBEE8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLBEE8C.tmp
Size 70KB
SHA256 bfacee109fa9dd22013f49f6b2c62f12236522592100a721ea36e88c957dcf34
MD5 1a3c5be7d0466550195ed5f2cc5d6ab2
SHA1 867941a0f0b78a3d243c4ed9882b2133e2720483
SHA512 7bf68d83ec858807be7510623bc59bd8cdcf78aacf0d1a9be1a8d699f7de6decc22e41c82b1c74f84bf5f6aa5c2dde1ca6d0c9d5e3e7c36a9ba163620ef3361b
SSDEEP 768:xl3mAx9v5OSFWOruZGkXreUK4jYFA4e+M9X4Tl4h0TAsGFHSSjYfUXs8nf4:3m69v5i/XaUK4jYFpe+rlTALBSSjsUXG
TLSH
T104639E153C40C773C81584705965C2A18BBFE8127AA9999BFF9C1BAF9F711D08B3633A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLCEFB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLCEFB5.tmp
Size 188KB
SHA256 739105d5981cdb3040a184c28f7d7bfaf0eabf2529fa81f5697cb7c42ba0e784
MD5 b285c45a315f4e85a94962151c5f2b09
SHA1 c0daee3a412678988fa1a9325c52cdca102e1711
SHA512 ed3ea4018fb1bd2859e8ebb74f0ab71f45096b687218ff748f6d581737385cc79b35940a2f6bbc2913d9ddec0902d168b5fd903729fce20ea83922bc4756d7b6
SSDEEP 3072:gz02Vb1SoQgFrCjZJcbZD+vc7xOZRpi6t3nB3Tw7ObZMTrSwQbCH3BSb:gDVJSoQgFejLYZD+vc7xOZRpiS3xyObf
TLSH
T1C7148E197185D037D727003DC877A7728A7DB8600B6E69E3EBD909E45FE16C69E28383
MD5 SHA1 SHA512 SSDEEP TLSH