81be5885ba8ef998066cd36efe6884fea44408ad663ea62666d973f800f9e63e

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe
Size

483KB
MD5

3ecad91b6dd833ebc34731f8f07341fa
SHA1

dcc36f7bf54db788bea8feb31c8b6705bf7bb3dd
SHA256

81be5885ba8ef998066cd36efe6884fea44408ad663ea62666d973f800f9e63e
SHA512

87e70824aafa1219897dc992244f36a0b29d4866ef9aa3e77d5ba3b320e3711d4e007d58b113e6cf8b0dea5b3f4b1919761f6b3d66ffdb3db8041779b85d9fb6
SSDEEP

6144:QTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrbT4:QTlrYw1RUh3NFn+N5WfIQIjbs/ZB0T4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\172866025525495dd8e8afca3f3b56403378ef77acfe3af22ea24afc36e105013588df0d1b286.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
a5e9d3a163bca5cde220349235c375a4

SHA1
816a50851a2d62e2fc5192fbf4d112a193ab06b5

SHA256
82cdd7734008f43282f1870b54b58cf9b5dcff968f044c2dc0516917882ed279

SHA512
05ef36a4687a375d996aecabdcef42f0d9c4e84e3c81ab95bf3be21b46e6f7f1cc1992ad936e333079b450159fa92900c87b8cc0bd3fa9d1469cf3854d6f2a74

Download Submit