9d83a44f6b584d99d1ffebd7c9b915f68056d697f0b1debe9386ffb78aae0deb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/11/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe
Size

483KB
MD5

0913435564d2912596cbc10e0d8b0636
SHA1

5b9a5caf1bb9576e938d189cda91d72bc3381163
SHA256

9d83a44f6b584d99d1ffebd7c9b915f68056d697f0b1debe9386ffb78aae0deb
SHA512

eb6b1e4cf6f74494f709c8ef66dabc7b2e841e32b1f2c529d0c394dc2b4fed4e1904dae2e20e7ceb9768e69f556681e25cb9483da973bf797e45f92bfeb85de6
SSDEEP

6144:JTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crET4:JTlrYw1RUh3NFn+N5WfIQIjbs/ZmzT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe

C:\Users\Admin\AppData\Local\Temp\1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe
"C:\Users\Admin\AppData\Local\Temp\1730477226c46d247f8149bb08962a395eff3ba2277df18f1516091fac7e907c6a25be5f0f687.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
38a6be9f79f125d6a3fdf7cb9361b839

SHA1
452f096cc9b4a5f24efa18646953a1428d248fbf

SHA256
216a18d1c6a0ad1203879706be8ffb5e3c5160d6ca03ad0b20e093babb0e7fe1

SHA512
75b96dce55044296000480f18df4338bc9d1d555d128c825a49f82d93d94f4e2c62306e49c9f23b6aa564df4ba2a1400084e4cd0f38c9840fd75e3ff3dc73a9b

Download Submit