adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
Size

482KB
MD5

3ca373f62b4243e9d5b8e71456880117
SHA1

5221ca168f4ddf13746f3424dd8f967d1a8f4bca
SHA256

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04
SHA512

7199cdd7e07b993b9bba3c8013c4f5243d63bc8fb52e8805be23adda5bbdb7e4240978a462f073fbf79913f0c6968e44e4cde901477df295dbff51e362e03d3c
SSDEEP

6144:KTz+c6KHYBhDc1RGJPv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrWT4:KTlrYw1RU33NFn+N5WfIQIjbs/ZXBT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2304	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
"C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
f1fe8e8dc4a64b377d8f07fe3b05015b

SHA1
fe7643b7c6d8646959a47896b4859c34feb4045e

SHA256
4878005b523b47348e103fd4e65d83d848fb3544739e0ade037e0b12f96207d4

SHA512
a2bac822a31507895d92c6e70c5b5c77888ddd0d29182a6f99b8fd33684f00e3100b1e86ed3e3853210ecb81176b5486f5084f6f12b1d9998aa2383bb5a835a9

Download Submit