10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685

Analysis

max time kernel
151s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685.exe
Size 10.5MB
Sample260804-zb4b7azapb
SHA256 10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685
MD5 857f3a48caaed186d420403e5f16c8d6
SHA1 72fc61b8627509fd327eeeba0a7e2f3fecb25ee0
SHA512 a627488163727b8a7eacaa47f14d672afbe778eb06210790b4b84b077a83c6ddc324eb7c9b87861479c9cea14fa37b09865e8a4274f2d792f8b0c2018f376ee6
SSDEEP 196608:4nDY7jLIZW9Ed14NTx9Pe20/aVHEiu6E:4DY7oZFzGdCahEie
TLSH
T1A9B6CF96DB823129DE2A6A70113C3CAFD519AEC507700BCB97EA7CD415747D3183AE8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	4416	10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4416	10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685.exe

C:\Users\Admin\AppData\Local\Temp\10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685.exe
"C:\Users\Admin\AppData\Local\Temp\10700042f6963029544d1b114eb9102af643909c4f9cad7f20a58be1ff0c8685.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 88228c31450261c20feaf2d896d34f772f079617ebc2a80f9293d8bbea654815
MD5 59af1622b59e4f9f7198de79e66957b7
SHA1 8a5fcf7c7e647d23c69197dd4415118c35f4a16c
SHA512 36771e15d3706eecc4f43b4424299903a95fce5246482d7ffbc7025c645022f277dd81a519b7d7159b7a2e6f276868bfb202b0f5013d520a56338b3fd4731f67
SSDEEP 96:KXbdRY69wN7HoH3V4xGPHiTHXbHoGHlDHEfVHEQGVHEdoHE0HE9HEuHEVHE0HE/j:4pRYSwN0+gaOZbaNybL7gcI9NkUxev1
TLSH
T140E14A003CE9C5363A1B52DDD5E63F554C9BB806A498C8D5EAFD16400ED3D482FBF86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 43eee02d127b78196808378276294c66c066bbfd445be36b3be8f5de2a13914b
MD5 fc5a6a9ef47d1c58cc015eb7b7abbc1b
SHA1 5549c268f53d0ddf57381c2c5dd84d602e2e85ea
SHA512 6a3adf12ed32be6765d47695042be74e85e7c834f9077710a235a347f799133e7a2e7cbf78666f68aa133a561ea65ea682980e26265a420df588f5161b76a10e
MD5 SHA1 SHA512