ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878

Analysis

max time kernel
147s
max time network
143s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1724650026a8e1ceb70062c09b0b3670a151d1ee2d8f06529a99d8a5702de685ec04134c58970.exe
Size

483KB
MD5

ccb8ba2e5828a30d43113b6dc6c38dfa
SHA1

64fe5810a25d07fc8acad540c53aa84f4e029525
SHA256

ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878
SHA512

fff3656bf7f4cab451ce8bf296889c1d8b7edb1c7e7a261187c3b7442982f2433c728a411854fd63f89368ab214b04010bbe0ee935f212d3ae26135c47b39609
SSDEEP

6144:QXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cND5Gv:QX7tPMK8ctGe4Dzl4h2QnuPs/Zoecv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1724650026a8e1ceb70062c09b0b3670a151d1ee2d8f06529a99d8a5702de685ec04134c58970.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2976	1724650026a8e1ceb70062c09b0b3670a151d1ee2d8f06529a99d8a5702de685ec04134c58970.exe

C:\Users\Admin\AppData\Local\Temp\1724650026a8e1ceb70062c09b0b3670a151d1ee2d8f06529a99d8a5702de685ec04134c58970.exe
"C:\Users\Admin\AppData\Local\Temp\1724650026a8e1ceb70062c09b0b3670a151d1ee2d8f06529a99d8a5702de685ec04134c58970.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
88424ccca1b27dcde258f02e06c77bb8

SHA1
ff84a469ae7999f23725619b58a3d2db36eeedbc

SHA256
2e2e245cd817bd5a53db0c2b401880017639fd67fc7f24a8a22c6daf23495020

SHA512
ae70f1de62c5125139c28edff6df70bf4886e32e924cfb12f0d25ecc6e621042e3fb64347293a9ad23846964ea71590c08dc5784726f7337099a96add8e360c5

Download Submit