0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347.exe
Size 10.3MB
Sample260815-nnj9aswtft
SHA256 0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347
MD5 2a7839f29194da88cd0c9466e26c75cc
SHA1 d7f76baa283caec949238cd001e27a99c699b772
SHA512 0ccbfbcb91f439827abf29d16b633cde65bf9c84b876b442553a50e3c165bcd39d80e553d79a2c7757d2c011ba5dec4370e22d64a8c0a53ebf147618f54f0f80
SSDEEP 196608:rPbRDhGiY7B3a4NTx9Pe20/aVHTiu6ENEuZ:rjRDbYNqGdCahTieNE
TLSH
T1E3B6B096DB823129D9395A31113C3DAB9619BDC50B700BCB97EEBCD405B16D3183AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	964	0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
964	0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347.exe

C:\Users\Admin\AppData\Local\Temp\0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347.exe
"C:\Users\Admin\AppData\Local\Temp\0ef9fa3a494f1af274b7b057a44903a1653cbc6fcfa03e36c6fd4ef596ad1347.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 5KB
SHA256 5d4c5091b93832c3a462b18bf281bf09016b3b7fd0025189cd6e12d51c9e39c4
MD5 b274a4a9cd494f33737c3615321f2455
SHA1 10f74187494c735b96c3f203a6a81e70311f0855
SHA512 6013e7a42c32ee98f968ea6ee40af245a3eb54cbab4d687fcf2c0ff98ed80155427c06b5eb0b55e1691cd0af5220d96d39167356622bbc38852e556c0dd99870
SSDEEP 96:KQdul4XSbrW1HkH9XLPHLHkHAZHEIHEWVHErHEDHEMHE8HElHEiHEO8HErHHHFH9:pQM0rW06/NogzDixGNk6v9g1wn
TLSH
T16AC15F063DE18D392E5659E9B4A93E518E987C2FB110CCE177DE09841AF2A803D3E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 3057fdfd50c87f24f5a5342b6db7473c2371b9877be18363e4de9175fd091443
MD5 40299aa5babb323c3c09b7e0129a014b
SHA1 03aef71e155601f596e08357fffb2f5e50701e8f
SHA512 c428dc264dffa72def79489587d5f48bbf54af0f88f32a399f56044fcf6cc67cee3e958ef0fb9b269f248b91a37ca5289aab05f0967555f20378fcf088fb1568
MD5 SHA1 SHA512