73710268628b6e68182c360fb53dc6475b31dacd9f46d05e98c0830019b075aa

Analysis

max time kernel
147s
max time network
144s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17290972857e17e6647ac26d58174b5fefe0786260e8980dd73b8a668e056eb8647ce5f2f2506.dat-decoded.exe
Size

483KB
MD5

3904babb53d5bbdab7e0785a533a58d7
SHA1

ce1f658c4fec558cd65698c766363f06c876bdbd
SHA256

73710268628b6e68182c360fb53dc6475b31dacd9f46d05e98c0830019b075aa
SHA512

df691df5c7ac7571d0838065f5bbf088133d690c192dd2b96165e558bc9685a2db8d6946a1e8c3078f1fe96c9f6d9d2dc1a996c7b58b294050cf592dbcb5f52c
SSDEEP

6144:oTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrHT4:oTlrYw1RUh3NFn+N5WfIQIjbs/ZXMT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17290972857e17e6647ac26d58174b5fefe0786260e8980dd73b8a668e056eb8647ce5f2f2506.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	17290972857e17e6647ac26d58174b5fefe0786260e8980dd73b8a668e056eb8647ce5f2f2506.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17290972857e17e6647ac26d58174b5fefe0786260e8980dd73b8a668e056eb8647ce5f2f2506.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17290972857e17e6647ac26d58174b5fefe0786260e8980dd73b8a668e056eb8647ce5f2f2506.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
391086fdb20971fe180191f12efa6928

SHA1
b81a83ae6b60fc59a377006864a0f06c20a20c92

SHA256
928108fc206809da71a27e623112e1e8e2cadf988d32ab3389b96a7b78d6b384

SHA512
23bc22606b616845e98342c50b8dc6944a3f85d1d7234c26dd96925911b05b7ad6251b6d12e3daa721886bc63715850b294cea6492272804b683acebe8f7f419

Download Submit