793d00f40edd3b5c80613768b4182c40cb369cfdd4d0edbdbfce1e2ecfb26540

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resource.exe
Size

483KB
MD5

e87002ed3fc5daebdc5c56255fa4e857
SHA1

5f10aa2596b7a6f859544fa8a90057196b343755
SHA256

793d00f40edd3b5c80613768b4182c40cb369cfdd4d0edbdbfce1e2ecfb26540
SHA512

7d7e63c05ec62802ff513ec257c61e7eaf2900dc6625c77cb6259172c4f78ba26eef211fbd36e3e21707325e1102506206ef0136b2919be141a7316a6560fd4d
SSDEEP

6144:mXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNY5Gv:mX7tPMK8ctGe4Dzl4h2QnuPs/ZDBcv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	resource.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
400	resource.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	resource.exe

C:\Users\Admin\AppData\Local\Temp\resource.exe
"C:\Users\Admin\AppData\Local\Temp\resource.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\日志.dat

Filesize
270B

MD5
28b7ff43a407b9c4449886632f50a39b

SHA1
8ab27d551ff8b767f6a699d52f0cd70ea493c94c

SHA256
3f6933db68f85a8ce01b15da5ee93ca444f259be8a7ff81dd113efa4c1bf33b9

SHA512
fc5da5a6b7b800c94c422f1ad1cf4a805698f41c61134f8a050b012660c73e1338508ccfdf2aee642545ad4bb843a161a51de9a7014d0514ac385f687e85470c

Download Submit
C:\ProgramData\remcos\日志.dat

Filesize
184B

MD5
6aeb8572ce654c7300623f783b3fb8cb

SHA1
2f720927390cba4bb96a2ed98ba1d3d21248726c

SHA256
7df663bfdc83d0f1f853626ff512a3984062e3c03d230deb5b2f17f3b08ff461

SHA512
d22a808bfac4ef0ba45fe80642c3da088e9093177014b61e7cfc2c5ca28d3bdba61615d5901a7f5c93f7da0388f4626bc6cbdb12c3fc334bc75a0e1e28c05ea6

Download Submit