a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe
Size

481KB
MD5

f304fc01ee11d8249245b35c4fa4191b
SHA1

147a961c90cda69b8acbc12cf07c5d25762b625c
SHA256

a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4
SHA512

9a924cbc7c47ddd1e0e067a9063ba9b526f224fd6e28e6fe9bcfa5ecd74f6bc2baf509a40cbcb4d6bcb76f0d316c6f165ff834719d2a9dd250d1659c2c55c2ce
SSDEEP

12288:LuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSo+DYj:O09AfNIEYsunZvZ19ZTsC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3316	a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe

C:\Users\Admin\AppData\Local\Temp\a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe
"C:\Users\Admin\AppData\Local\Temp\a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
6ec66e1d29280db29a0624ca96e94725

SHA1
091550560fd80cc08623bb11d39e61999706c31a

SHA256
7215d22047fdb55f01d11f6abe8c9376db2857c4e72520cfe8e779799f30c76a

SHA512
0919c03b3bd1f6dc7edcb18af1396e5b90d8c99dcb73c529a14f14bf5e2ce146804f2647e330ac140cb4837398b45df217a540e025ac6cbf6aac76b8048e27c2

Download Submit