adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04

Analysis

max time kernel
148s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
Size

482KB
MD5

3ca373f62b4243e9d5b8e71456880117
SHA1

5221ca168f4ddf13746f3424dd8f967d1a8f4bca
SHA256

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04
SHA512

7199cdd7e07b993b9bba3c8013c4f5243d63bc8fb52e8805be23adda5bbdb7e4240978a462f073fbf79913f0c6968e44e4cde901477df295dbff51e362e03d3c
SSDEEP

6144:KTz+c6KHYBhDc1RGJPv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrWT4:KTlrYw1RU33NFn+N5WfIQIjbs/ZXBT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5088	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
"C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
ff178a2320b4f40c296671f9e8354881

SHA1
171fd95d39d0aca3f1ed379b81d63024322d8ba5

SHA256
da3ca04713f63f30666390389ee9a763eb1feda64687203addb11d7406ff4e01

SHA512
854ca5e60ac8070c6c01b11c4f9a9162aeb1d3f7a0c6ce21ab1510617d3a6c39a3c414c999c54f0603c99e95a2510dd974c2c195856f262ca22e71c7af0e024e

Download Submit