4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912.exe
Size 10.4MB
Sample260919-sjkfqaxt2l
SHA256 4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912
MD5 694bef2bca71b38fbe9d4d73fe041f38
SHA1 2adfaa08c6fd744eef2e07b25333adfb6e3b8ab0
SHA512 ef8696df331cf50fc8224960d9d1aeabb8c950ead9ea1573396e679789877c08d911c2e8f54031311e7a69a77f2972742a258b8a4fbcea2f04d4b06db8a554eb
SSDEEP 196608:/ZyhPtNAbOy3wShLNTx9Pe20/aVHXiu6E:/Z+PtNAH3wShZdCahXie
TLSH
T1BDB6BF46EBC22125EE2A6E30593C7DAB4719BDC947F047CBB6E9385414716C33836B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	3772	4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3772	4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912.exe

C:\Users\Admin\AppData\Local\Temp\4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912.exe
"C:\Users\Admin\AppData\Local\Temp\4374345af5d58cb616a4b61caed5918fd9ef6cc7dfc70965d4fc4b3766492912.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 5KB
SHA256 4928f07e990e7afb3b2ff47129e076a26d71bb0bfae8b05ef1c46c6361bd72a3
MD5 f5b3d20b38d9e9e514221b964458453f
SHA1 99b3116b19d7423f61af444c3e820b28a9e7b8bd
SHA512 68de49f5e10edbf250daed4fb36a0672d053a3c00049e05906e7bf7c78b653ed809d7fec28caaa11c1bf3d4b7609af25f394a9579811d5db991c99aef7180239
SSDEEP 96:K0prPVBaH3HdTXONnHjH8HsuCHZH4VHlH1H2HCHzHjHS8HVHhHEjHE0HEEHEkHEe:rRVBKTXOSqAbLrFs
TLSH
T1C0B1AE0179624D2E365FA658B17A7F56CC88392D2C25FAF37A8B0580C9837843DBF116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 cc266fb5fa841c22ff7d99f00a64a4f7d3edaed3c9f424d79222f527fb0fba9f
MD5 a62558f81666bc69428f151293ac75ac
SHA1 044722f64dd99496ba01897d4aa92e09f8cde23d
SHA512 1a9b24595b7084e720c85116e0b59672f047dee6b23c380dca45b100a22925f5321cf078ded54810d966e77664faa382fd742db21125d2ad257fcba6b47e990a
MD5 SHA1 SHA512