a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe
Size

482KB
MD5

2ab4bee747d1daa1089e5a993f2bdedc
SHA1

535505d611d099f37a87e1b08a4de3d02a13c024
SHA256

a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad
SHA512

d5418ba738316dbc3a37029490326cc61ad5e61de324d029861587e66758c3f685deaea7069c09ffe22da5bbfa292181d78276d975c70fad59c276775b44bb6f
SSDEEP

6144:7Tz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crtT4:7TlrYw1RUh3NFn+N5WfIQIjbs/Zm6T4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2872	a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe

C:\Users\Admin\AppData\Local\Temp\a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe
"C:\Users\Admin\AppData\Local\Temp\a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
e1c21ecc765056adc6b0bdfc4660511a

SHA1
0f5f58d45da412083c1d9e84033ac3a5bc34a83f

SHA256
b7800465899ece6b885887558cc62600aa269bc2e75732f9f3728f5ec4a14e71

SHA512
27d950341e52e19d04dadc84d594ebb7828efe873efef936d03f751a6f75a268f84f4b128202df9f2b94427de8c831dd85ba2fcc8cf4cf26bfff8cf67e436c75

Download Submit