adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04

Analysis

max time kernel
147s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
Size

482KB
MD5

3ca373f62b4243e9d5b8e71456880117
SHA1

5221ca168f4ddf13746f3424dd8f967d1a8f4bca
SHA256

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04
SHA512

7199cdd7e07b993b9bba3c8013c4f5243d63bc8fb52e8805be23adda5bbdb7e4240978a462f073fbf79913f0c6968e44e4cde901477df295dbff51e362e03d3c
SSDEEP

6144:KTz+c6KHYBhDc1RGJPv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrWT4:KTlrYw1RU33NFn+N5WfIQIjbs/ZXBT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
"C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
0dc7ca8b2e86ace6a92cc7b6114ade92

SHA1
cc2979847d4744d1ad6a54d4561323c19a2c2b2a

SHA256
97578ad96324acc7205e7cb79c409f36e7715fd2bcaf31e743fe52428ec2e172

SHA512
d2860b158776021c0ffada96f2896de5b7dabd8b1939fe9362f050b7ef1fb16432b1f7d14dbe909e41ebc534c834723288a487db89ee4247da3d94574b491165

Download Submit