adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
Size

482KB
MD5

3ca373f62b4243e9d5b8e71456880117
SHA1

5221ca168f4ddf13746f3424dd8f967d1a8f4bca
SHA256

adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04
SHA512

7199cdd7e07b993b9bba3c8013c4f5243d63bc8fb52e8805be23adda5bbdb7e4240978a462f073fbf79913f0c6968e44e4cde901477df295dbff51e362e03d3c
SSDEEP

6144:KTz+c6KHYBhDc1RGJPv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrWT4:KTlrYw1RU33NFn+N5WfIQIjbs/ZXBT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3944	adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe

C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe
"C:\Users\Admin\AppData\Local\Temp\adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
b73f4a0ae3ee496f175f8a520d255308

SHA1
7074215d0d78d715b84e315d9b0a97303000d23e

SHA256
04084a196403e143c63510a59cb7bdddeebce5f975c812b344244ab61a8907c6

SHA512
76f30b4cc1e1bcac5e4d1a69195486d54a4b65f9797aa67435f4df93534ab8c37ba5fbc0a621722cd8d773ead568ad54f10aa1aef4d60ac3e0d2f871c9adbe8d

Download Submit