9d83a44f6b584d99d1ffebd7c9b915f68056d697f0b1debe9386ffb78aae0deb

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe
Size

483KB
MD5

0913435564d2912596cbc10e0d8b0636
SHA1

5b9a5caf1bb9576e938d189cda91d72bc3381163
SHA256

9d83a44f6b584d99d1ffebd7c9b915f68056d697f0b1debe9386ffb78aae0deb
SHA512

eb6b1e4cf6f74494f709c8ef66dabc7b2e841e32b1f2c529d0c394dc2b4fed4e1904dae2e20e7ceb9768e69f556681e25cb9483da973bf797e45f92bfeb85de6
SSDEEP

6144:JTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crET4:JTlrYw1RUh3NFn+N5WfIQIjbs/ZmzT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5040	1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe

C:\Users\Admin\AppData\Local\Temp\1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe
"C:\Users\Admin\AppData\Local\Temp\1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
17d99e1b1033c8f39bb62af535d4433a

SHA1
1cc578f1b245cfee64d7225177db008a44c1bd51

SHA256
fb91c1b2a388b15a02ec04298d31c1b3e327a63e92e059a071357c7a930383d6

SHA512
ebe6ab90874cb8283157fd6ce0b63034ac511e23d7144291412438fd9065d5f1b5d176daac678550b80868a992f4d9634ef2e60cf2ec3cea86be3246b0b689dc

Download Submit