064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe
Size

469KB
MD5

57aaaa850545013d0435ddd70c24c36b
SHA1

c393c30604ca94a8f5833c80309bcd26d4d8fce5
SHA256

064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc
SHA512

a448b21e2779f7a4334adcedfe29dfb7754c0ed5ecbf060d833795f00021b2031f3ebe07f9353c34f88927c27202214b35ad97454e89a2746b773dcf5a90e3d2
SSDEEP

12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSiCn9e:2iLJbpI7I2WhQqZ7iC9e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4472	064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe

C:\Users\Admin\AppData\Local\Temp\064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe
"C:\Users\Admin\AppData\Local\Temp\064787fd7ce88c33b8a645938eab967a796599eee324a104c5c6ea2b0b2ff4cc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
1410db4aac477b2ff2939f3de899258d

SHA1
2eb6d46e1eb39b358bda47fce1becd91a273d096

SHA256
46553e3a2290e0e4b7612e01728c4c2a3d5b48c67398b7a979838e84d5eb708b

SHA512
ac59e3b7c93bc8abfadadcc91ce3cc1ac8f3c66f056ab16ba3497d6a1680d8109b04e763c0d20e76a2a5a23e1eb4146c3395a6aaa478885736a81faa707acc22

Download Submit