72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27

Analysis

max time kernel
165s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27.exe
Size 11.6MB
Sample260826-arq95a1bme
SHA256 72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27
MD5 46c36f956e4bec578d73091d4342700f
SHA1 51376a1a4ad2d57dca6744d1b10b2917a60b62ee
SHA512 85f8b4407a4e2eadf67c33acf4647b9189669fba4d68a2fd6527ab18134fd13ce49a5f8184b71a99dc7657c166076a4a59b508e8f6611207266509904d52517a
SSDEEP 196608:SdnwRZenXaHH5tOMmpYNTx9Pe20/aVHdiu6E:SJwRQnXsZt3EmdCahdie
TLSH
T1A2C6D096EB813125DE2E6A31153C3DAB8215BDC91B700BCB96EA7C9445717C30D3AF8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
35	4268	72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4268	72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27.exe

C:\Users\Admin\AppData\Local\Temp\72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27.exe
"C:\Users\Admin\AppData\Local\Temp\72c5cb2a65e08cac8be71cf7178eded9845ee2a9425fa41da9a9d3a709604f27.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 e8a7091f1a9f454d5959c30777c3f413cf97290994b0eb6a94d6c97ee128e086
MD5 d815c36ce4d3dcffecb4566a88ee443d
SHA1 02c82a1b76d594d3b770d51f070a749ebdb6772f
SHA512 28b85c7fd9c7bcd6fd4aa9c3c1c4a779cd660ac428b37d035b54ee47638ce46e3e95ec4c51053400700ef255b164176786a1c16884a08c596ecddb7bd0a31cf1
SSDEEP 192:2rUPps6Icnv1qHn/sz3bbjOS7kBdco3fym349J5vbYfagU:/Pps6Icnv1qHn/e3bbjOS7kBdco3fymI
TLSH
T15E128C167CF1DA301A1762D8F1692E937D89B20B61A858D162DD860CC8DB60DBC7FF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 814b078562fb535f273d606d80bb149da3b4600a037d8b6c921990b62cef1467
MD5 6cdf941bfa25f796df0d0fce0bfd6bc2
SHA1 aeceeed6244f99582fa34dfae27b8ae9cefb86ae
SHA512 e15efe60c2c8d50c2b3e2174c5288a072c5aa2fb4dd79af448206e80b1fa83c2d0bf7690dba1eff82cde5bb7ef572641065d633c84494b1a45e54f6307d40b8c
MD5 SHA1 SHA512