09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f.exe
Size

481KB
MD5

c51a0897fff26f97d73d1004f774c835
SHA1

582754cbbaed0d4663d4865437c388329ca28ead
SHA256

09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f
SHA512

7a21e350d04eb5f3cec118782655a3aaac32beab9327b99d29a45f4e7ca1f923538ab1924b1d7efb03a63765729634babc2e14f4d96594bcc02db9adf5218300
SSDEEP

12288:3uD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSF+DY:q09AfNIEYsunZvZ19Zis

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3116	09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f.exe

C:\Users\Admin\AppData\Local\Temp\09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f.exe
"C:\Users\Admin\AppData\Local\Temp\09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
65cb7be982bd22f1f1d9b507a60a7dbd

SHA1
384f45016c042fc903e716e02901deab8799987a

SHA256
33acbad8392d564530d4b81ce6d0ebfc98cb1916d1bd6a339e30d55d6066938e

SHA512
68e536d44bc3d3471a1a04fbb5722f59074ba33eae7e8b26d7453d972471028ca9ac37a8d9a63d6bdbd4448e55e66c9c38be74bd748c72017d4e5391ef8a7c85

Download Submit