81be5885ba8ef998066cd36efe6884fea44408ad663ea62666d973f800f9e63e

Analysis

max time kernel
147s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe
Size

483KB
MD5

3ecad91b6dd833ebc34731f8f07341fa
SHA1

dcc36f7bf54db788bea8feb31c8b6705bf7bb3dd
SHA256

81be5885ba8ef998066cd36efe6884fea44408ad663ea62666d973f800f9e63e
SHA512

87e70824aafa1219897dc992244f36a0b29d4866ef9aa3e77d5ba3b320e3711d4e007d58b113e6cf8b0dea5b3f4b1919761f6b3d66ffdb3db8041779b85d9fb6
SSDEEP

6144:QTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrbT4:QTlrYw1RUh3NFn+N5WfIQIjbs/ZB0T4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
65cebdd1849149c79b19a892bde01621

SHA1
1e6abc392334503b43298ef8fa14450144fe4d99

SHA256
bfa1030e53f901cab9f26d4d8f78f58866a7f997e8adbaf8f43d51552e72246f

SHA512
17a71bb02a2e52ab5c26ece79ec691566914069efb0ddec876ed405535ebf4efbbecd211062e997943226f9451d2b14fb3f4b83b96af2177824b6206c4ceac1d

Download Submit