Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
20/10/2024, 19:23
General
-
Target
remcos_a.exe
-
Size
469KB
-
MD5
f08b719bbbbe4fcfa6ce173ca3314fb8
-
SHA1
4c81b3cbe397145897f914cda53f3577d8f08d8a
-
SHA256
d60715b80d1d2508766941737b5768d7805451a5cd5cfeebd759e6884a1f0662
-
SHA512
98f53ee9329c40f57d8d2c7c4acd7ca047ddcc37e1c7690c12104387e98bb58e52c3b6e7269554cf778dcbce74e9b5348bc0b9f605734550c05439313668d76e
-
SSDEEP
12288:Ymnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSEn9:IiLJbpI7I2WhQqZ7E9
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage