064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe
Size

469KB
MD5

57aaaa850545013d0435ddd70c24c36b
SHA1

c393c30604ca94a8f5833c80309bcd26d4d8fce5
SHA256

064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc
SHA512

a448b21e2779f7a4334adcedfe29dfb7754c0ed5ecbf060d833795f00021b2031f3ebe07f9353c34f88927c27202214b35ad97454e89a2746b773dcf5a90e3d2
SSDEEP

12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSiCn9e:2iLJbpI7I2WhQqZ7iC9e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe

C:\Users\Admin\AppData\Local\Temp\064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe
"C:\Users\Admin\AppData\Local\Temp\064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
5ea0619d62ac4560567b2342a1c2015f

SHA1
d88980f6b45b3d4c11df51000493f13f0c5d9ca1

SHA256
932509874ce9bc3ea163e6d62017351878984ea7d15b9f53e5beb7aa1bf562bd

SHA512
0ddb7f12f9e94c7abf55f2c22e9008bc1373bccc4f99daa6d318f2d3175a4d63d54764b0b6af772ed7f968667f8e9180c50c8035f3d91a00202923b4a389bba6

Download Submit