3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7aN.exe
Size

481KB
MD5

2fd7128c1100dcdd5458e56bd4d36bf0
SHA1

e5b2e8a0dd9dca728c72cbcc7b2a08cc9a82b9b1
SHA256

3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7a
SHA512

54889c89d6c01640348acbff4e7313b6479deacf7e23108b669dd3179540cf16bb3a54ab277ff4eaf05f654d59995325c7e06b8e7adc199566b09c6fb99aa926
SSDEEP

12288:3uD09AUkNOGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSY+0Y:q09AfNOEYsunZvZ19Zvj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7aN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2064	3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7aN.exe

C:\Users\Admin\AppData\Local\Temp\3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7aN.exe
"C:\Users\Admin\AppData\Local\Temp\3bd7c81055d4542e364a93a28ef6b68d01104cb2559d678e821fd7a55221eb7aN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
44b0ea11fd8f4c4dfbd02355964e82f7

SHA1
9bbd2edbf6463154c3d7bc8f784a7d224a528f3a

SHA256
a347e56f3ae53eb0c26abc0e44dde01be294af94ece24089bf84879400d8e500

SHA512
2a6eb3c1d3477810f2a9b081b1bb61e0b1b2ed0964f7673999dadd7a3adea53974285cabc9a41c37781dbd35f983abe9fb202d88c68810f08ed76a2e0bde3995

Download Submit