dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe
Size 11.4MB
Sample261011-t25p2sdd67
SHA256 dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558
MD5 267ddc7610b5e6159b0d251c8c2d8707
SHA1 e2328671a4148ec7f456b293e1ddbc38a24d22a9
SHA512 8617cd693bdb303be18423445fb16f8dbb392590633254b49f7c32dc664d2d624b43a518d01b86a78e88888d6795a20f190040c81249d66035799b464b49ecd2
SSDEEP 196608:xP1yj4RzJYCAq6nIHlhmZNTx9Pe20/aVHXiu6Em:xPcj4RzxAq6nIDmzdCahXiem
TLSH
T1ECC6CF46EB812125EE2A6E30593C7DAB8728BDC957F047CBB6E93C5414716C33836B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	4984	dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe

C:\Users\Admin\AppData\Local\Temp\dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe
"C:\Users\Admin\AppData\Local\Temp\dca245a46c730f02f3075cb446e5270db5004ee0f46cebdfe16c7dcd9aaa1558.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 4KB
SHA256 1b56f8b4909c48f82d62ccbab23e15dc36aa4778a99699a5a8ac74c5313dd22e
MD5 7cbf04505cee5a3a375144b92233d8cd
SHA1 0206b8934eefa92c584cbc3e0d648d3e2771f0ee
SHA512 4e7ff6988110c774dc8972ad416a6e2f084952eae186f14032a44a8fd979f6dabafc1556d2915aa39b660c7fcf881fdc992227d2d1cf8343a5f2b2bb31fc9f01
SSDEEP 96:L2IMGd3vJMSH6HztHxHVHigHyHbVHwHqHaHXHgHwHz8HeHCHEMHEVHELHEIHEWkQ:LdMGd/JMVzyI/WB
TLSH
T114A1B1443A66FD751A9953D870BA6CD2DC54B036F734F8D5E2AE620024E7E102DBF0D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 9KB
SHA256 e2f42580f98a9041e2a6f5b8bfc3ee3db14d884c2c52596569724fe584772c79
MD5 a3bc73cd6d6a0412f920e92b4760019d
SHA1 8b6fb06a5bd38a30f375026205d213659159843a
SHA512 3316698e1e71942913d82da0967492c9adba26ac8ca3ad000bbc3bdb53c76b84d639fa3669e8995ce79a3f28f094f11aaac7d25dca754fe3ecf0b5902ccce24d
SSDEEP 96:L2IMGd3vJMSH6HztHxHVHigHyHbVHwHqHaHXHgHwHz8HeHCHEMHEVHELHEIHEWkD:LdMGd/JMVzyI/WdR+o8XQ9zzY
TLSH
T15E128D443562FD711EA652D8B07EBD92AC98703AF224E8D5E1EE520068E7E107DBF0D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 eb8ae79695adcf7bd4b2ee1d7634f9154b2377f8c38e2d322ad9ea588233e558
MD5 e88b794f670fcbcc81f7c5e2c06a1279
SHA1 2b8932b1bf244c1aaf5bd2cd9fb69be5c82209af
SHA512 f3110ba982009e4cfd263ec71cf8ac888fd9dc1ac8f0832e842248ca4f94b61b775a2f69ecd5ab92077f16ab329c4b3222a24484ae17706f7fc3c3a2b826066c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads