4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe
Size 9.0MB
Sample260819-ffgjfada78
SHA256 4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c
MD5 0984802e301b50b9ecf3d20b8ddd02f2
SHA1 fdcac2476c671ed467e85a20b739f16c921d1552
SHA512 e0c19b49529b5d989fcfd5b491b6a480fcbfaa34d942ad35c1285925bd386d7d5df108c46da4987d260e03c3781bf4d3e222c184d79a20384389fe4099775206
SSDEEP 98304:4ULUtNASsCPdoFv50Lu7xNTEY9xFUkcVwNSHfbv2VHnXIhThw6EuK:dSAnIYqCdNTx9Pe20/aVHXiu6E5
TLSH
T15396C002FAC12605EB3A363022797D7F9726BEC45BB00ACBE756798815757D20835B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
19	4212	4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe
29	4212	4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4212	4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe

C:\Users\Admin\AppData\Local\Temp\4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe
"C:\Users\Admin\AppData\Local\Temp\4836b7b5839aeff0cd7e2dd1f847660b9062c21617a9b1ec4e92813946b3c27c.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 6KB
SHA256 85addd80d4020c37fd18e2e75eb53c22118307d733046cea232b797d5e2412f6
MD5 c094c74b8bc6e4fdfb6b63a5f3fbeaab
SHA1 dad780a798b394845c8f4077ef53a719df25a053
SHA512 fb87e8fe36249fe5f26d8815ccbd5b0d07e15b2abbe8960440376424f549e25771fb0e5f8cdd8fb19702a990918de4359cf3f45d6b86f5145866c74a56fb201d
SSDEEP 96:KyK3rtMDucurXwzEIoeSefeIIHIvH6/66KwezKPH8dHJ1HKwMHnXHgwVHdeHOFHd:s1XwgXaVMHPBF
TLSH
T189D1AE057EE58D3C1E1BE1D8E27E2E61CC89B85E601CE8E1638D564029D2A19BDFF076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 2a517d66b13df021ee9725f75c097e458300bc36ca08598f0e0580e7a11bce97
MD5 5fe132632438dbbd2b56c7afa0fd621b
SHA1 692cf44c4eae4331f06c3ba3db12e2f3beee2626
SHA512 f9ab8016915a68535b6d4a22c804e111d0948e7d05db717f17919f1e5f1faab886f3d7da3f3a95ca733b97ad768de96bde11f2c1a6d2fbb18036d9da7bee14ff
MD5 SHA1 SHA512