a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe
Size

482KB
MD5

2ab4bee747d1daa1089e5a993f2bdedc
SHA1

535505d611d099f37a87e1b08a4de3d02a13c024
SHA256

a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad
SHA512

d5418ba738316dbc3a37029490326cc61ad5e61de324d029861587e66758c3f685deaea7069c09ffe22da5bbfa292181d78276d975c70fad59c276775b44bb6f
SSDEEP

6144:7Tz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crtT4:7TlrYw1RUh3NFn+N5WfIQIjbs/Zm6T4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

C:\Users\Admin\AppData\Local\Temp\a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe
"C:\Users\Admin\AppData\Local\Temp\a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
0fc8dee05181b8f0ab2249ed328e9958

SHA1
4caeb2744a8479823dce405e8dc12891131fe756

SHA256
27a86ccfeecff3ba9bdb4ff2bd44d4548b9f9955a99b5f15ba5ebb43903419d4

SHA512
0fe50900c87947de409b598ad060016a67aa6ddbb0f85da93d4862d6c72467e12d85a4b528ac7e65f136c35515b1bb3e6146b0e9683dc03ada32b4c51abbfc46

Download Submit