621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632.exe
Size 9.1MB
Sample260804-hvb9dayvez
SHA256 621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632
MD5 98d9d3e6542eaafb0513f550da049135
SHA1 ef20e51f2c01a5aa776a3036695ce29a40efaf58
SHA512 aaf5aac70630a9e029a41359cb6c358f175e31cb9e0708117720d4986983583951537475895c976b773f2c25b86b4ffc3800b89d19ba1fe453e7e137b97c339e
SSDEEP 98304:MnbGnR+V3UdbPeqte1HxNTEY9xFUkcVwNSHfbv2VHnXIhThw6Eul:dnWUddGRNTx9Pe20/aVHXiu6E8
TLSH
T1F2A6C006EEC52501EB3A363022397E7B9625BEC41FB04ACBD7567C8815763D34836B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
40	4544	621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4544	621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632.exe

C:\Users\Admin\AppData\Local\Temp\621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632.exe
"C:\Users\Admin\AppData\Local\Temp\621a51e8d6b60f7b38137493e3747481baed58d16e0792812fcf698d11251632.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 c98833b76523f5d5cb913ea2d3be3d8ce3a1d79de7c6e999c3b08a47549e88cb
MD5 b4281a50650113ee2cc90ce8ae813232
SHA1 f581fedad4c12339ee0644f94ce63bf5e34cf947
SHA512 e18063fdb965492237d9a8b80cd384325ae0b262a871e171d6e6230c94870ec673949874a889bacc5fa7f69df329954d18d7c49d7ff8bce88695b86383db3f23
SSDEEP 96:K+fhOJ9YnH1HRKnPHCHpHduHtHnVH2HiHKHAHvHuHU8H5HrHfHOHxHEOPHlHpHd8:ZpC9YvbW0
TLSH
T1A8E17F853DF455332A96616DD0967F998D4ABC1CB948CCA1F1FB02895CF29423C3F4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 b5c34dd25274250b1d763a57fcf1226dba83b237f53d24e0151469aa7cc65758
MD5 846c5f8f5b1b3b17b32e404f1dd9450d
SHA1 bdcab807fe34038844d4d7d5c04454d919dc900f
SHA512 867e22e7febf2921e738005611f86044813ebdd7af5a12d9652f7a505b2605395e92c12f8149ab3fbd96121fecfa4bb8960b5917e4872c5df204b7907c012d7a
MD5 SHA1 SHA512