b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5.exe
Size

481KB
MD5

a7ee819bfb900ad6d20ebe4d1da8af4c
SHA1

b50f78b7447b040f57d115c70c5fb4e62cac70f3
SHA256

b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5
SHA512

2683efbd00d03bc838e65b8bcc0640faabfbc63e9055b5b81aa42f338b25cf5998271df877fdf5f8fe4a13a0f3d93cdbf0ae71261753333702a79a824f5685e8
SSDEEP

12288:3uD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDST+DY:q09AfNIEYsunZvZ19ZAs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5.exe

C:\Users\Admin\AppData\Local\Temp\b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5.exe
"C:\Users\Admin\AppData\Local\Temp\b6331431d23acf4528527316a993890117bac208c604b054622efee21cbffcf5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
7de0ec2a464e59af79806f93e8b8f202

SHA1
91c08d1521fe34be39e9b264046f20f6b11bd4d2

SHA256
ce75c36d3d04c9cdadc1b170fcd7b0f70c1da0d4a562290bac2bc4217cd2652e

SHA512
884ecf300047caa7089f8491e6f9ea3ca1b37eb50a4efd0154f49277d78269eb5128f9fd80e4ff0911df08580f648d1e21e5e9ac35c2787b161ea576dd77d866

Download Submit