a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe
Size

482KB
MD5

2ab4bee747d1daa1089e5a993f2bdedc
SHA1

535505d611d099f37a87e1b08a4de3d02a13c024
SHA256

a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad
SHA512

d5418ba738316dbc3a37029490326cc61ad5e61de324d029861587e66758c3f685deaea7069c09ffe22da5bbfa292181d78276d975c70fad59c276775b44bb6f
SSDEEP

6144:7Tz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crtT4:7TlrYw1RUh3NFn+N5WfIQIjbs/Zm6T4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

C:\Users\Admin\AppData\Local\Temp\a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe
"C:\Users\Admin\AppData\Local\Temp\a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
ff178a2320b4f40c296671f9e8354881

SHA1
171fd95d39d0aca3f1ed379b81d63024322d8ba5

SHA256
da3ca04713f63f30666390389ee9a763eb1feda64687203addb11d7406ff4e01

SHA512
854ca5e60ac8070c6c01b11c4f9a9162aeb1d3f7a0c6ce21ab1510617d3a6c39a3c414c999c54f0603c99e95a2510dd974c2c195856f262ca22e71c7af0e024e

Download Submit