d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe
Size 10.3MB
Sample260928-ml58ba1gla
SHA256 d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075
MD5 0c27bee3140f6b4e01690202535d14a4
SHA1 5e4e72806e372ff52dab1270f92b0df7de1a164c
SHA512 1f7b6e0d8c1700b2905e7031620572bcec25600776942e4fc190a92581bc9e9552e61190f975393c0c270c2671d85b7f6b73af643915f56e41c435291afa2032
SSDEEP 98304:K6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwK:x++YIPiGBUtvNTx9Pe20/aVHXiu6E
TLSH
T1BDB6BF42AB812525DA2A6E30593CBCAB4729BDCD5BF047CBB6E93C5414716C33C36B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	4072	d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe

C:\Users\Admin\AppData\Local\Temp\d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe
"C:\Users\Admin\AppData\Local\Temp\d058a3149a652c93bef183b46638912250e97707e87a037fe6f84f059144a075.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 2KB
SHA256 b714814e7138383ea40ce14545c12f4f820a6c2af56f8abae0be7a9b0691cc7e
MD5 a3cf05f827b5757f969c81eed2bbdad3
SHA1 d438c9870fc0ddb3979778167baffa63e51631ea
SHA512 787dd9d908fbf7b2cb4c9f52b90fc18625568d7d42d7ecc5a461d4abd516e488af6d6d1d667ba523b347c633e62c844b36bded0bb2da3165d1585dd8cc40daa6
TLSH
T10B4144147FF0D732176C410A21310B67C918B848BBB4CEE4B6A43B9829A58567CFE194
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 07e434b7e0dab5cba4ac449f9425f8b7dd06b43a3cb8e7d7c0c4f88e1f9cf6f7
MD5 239644521eaff60d96a5ceec8e3450a6
SHA1 adfb2ba37a484a70e293bb43346d685056686360
SHA512 aaca4f58e4448effdf4770273532a807a50157c559cee65f440208e574bcacfdb997d131fde5b8b61ce5762f95037950129009571a50b045a44e9b974b66a369
SSDEEP 192:A+7rEwgd+QsrcgPrHUedk97u/lRfNkJVU:/7rEwgdVsrcgCu/lRfNkJVU
TLSH
T10F02DA103DF1D73116396264B1762F67AC8DB94C61A0CD91A2DA1A843CFB44ABCFF19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 650e5c0172f487ccf566a8a69d23aa89b352cec4fb766c2f549b85292f5c1358
MD5 ed87715f95bea8ea9ed4d451158654f0
SHA1 3806a40392e9a13b380fa801f38ee01eb74d97d8
SHA512 9ada9a45f536e264618267aa76ee4a2fa500f726e7bcb961d5c50e7e5080f9a304c0afc21c8d076833381e910083aaf88a8d33bbc4f23826b46df0eb6c629a23
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads