62e337896c7eb9ef1c48e2131660953fa6320fcbc07600fefa7dd71663d4d1b4

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yandex.exe
Size 12.0MB
Sample260806-plv4fsvxaw
SHA256 62e337896c7eb9ef1c48e2131660953fa6320fcbc07600fefa7dd71663d4d1b4
MD5 903c712bf1c5bcd20409c3b08985723c
SHA1 75959d0da1e7dade5ce16b9b8e4453a7534e00e0
SHA512 f7dbc0fbb7db31120e8ccbfa6865241390472bdca312d9eba0a4739436c709c0ccb0e4106516ffd0a6a654e05f6e581d1b6de94beace0632d662540b73971a09
SSDEEP 196608:Bhm3pKXxFaItjlNnMsJFkNTx9Pe20/xciu6EE:G3pKXxFa0ldMMqdCxcie
TLSH
T1C8C6D187DB823169DE2A2A71153C3CAB9215ADC94B704BCB97F67C9406716C31C36F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	5420	Yandex.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yandex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5420	Yandex.exe

C:\Users\Admin\AppData\Local\Temp\Yandex.exe
"C:\Users\Admin\AppData\Local\Temp\Yandex.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 9KB
SHA256 c55474e894419f344abc7a993936f077c0d6380c1d9d3ffd0341ca662677582b
MD5 0c525941df22880cb6d40e060dd78af1
SHA1 6ec36c238e200f2211e01162e4d1d26af1a9b97f
SHA512 0e91b98fcd8c1c05442c16424b05184879db0d2e798a773c7874b8f8638d8e5b906933c66b1a9ec87e2682880b15d1233403281a8615304557d2d89582bd4636
SSDEEP 192:PRZ8PGCADmUawHRjwyQr932C00OlPFM0Q6qjHEL/U:pZ8PGCADmUawHRcyQr932C00OlPFM0Gl
TLSH
T10B12E28678FFD5252B1B61ACB4692D51DC9AAA1C5008D8D1B1CE9FC878F31407E3F46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 cdd879dd816a8d98225d92132361fa3417337200d7af56c9488889a552221cd0
MD5 d4164e269210fb483e314f8cbb9d2d4b
SHA1 c54a8b5546e43ef145f7a94053a9525f73ba4edc
SHA512 ca9b684136bdd4129e15ef1f7d3820aab4551c1e125b6cb651ce41c6add00f7d99a5d98df3afebcd0faa45d9ff2d6c451e2977530ea527011f3cda28ec4f00f2
MD5 SHA1 SHA512