18017a0f96e0da2be7e93c7c30527efd622d9a670b86d0adc098b5b28d100206

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 10:15

Target

remcmdstub.exe
Size

58KB
MD5

ba2a1815e16b357eeff23b8394457aa5
SHA1

2492e2393cdaed5678ea0a573c50d06ec5f191f4
SHA256

e14c3224215ea91587e96b995861e8966166dfc08ab4d409bd729770815b3b81
SHA512

d505a1a17c44a96e74f94238b3623d7e6064b8c94007f2d94d6626eeee3ba75db92e569bc864c90096eabf61a0cd68ae690461b43b6e429b4deda1b44e18ba41
SSDEEP

1536:Wf6nvXuNcAjJMBUHYBlXU1wT2JFqyuAQYPT:g6nPcjJ4U4I1jFqyuHuT

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

remcmdstub.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcmdstub.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcmdstub.exe

C:\Users\Admin\AppData\Local\Temp\remcmdstub.exe
"C:\Users\Admin\AppData\Local\Temp\remcmdstub.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2532

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact