311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe
Size

481KB
MD5

fa48843ce9a50a4bc84f6996923b7a27
SHA1

29df9451a5aae33ddca11c26163d1c276bf2ca65
SHA256

311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7
SHA512

d1f1d6b6268bf020319ca282483df3b8c05f28993f88faf04b0d26c4db5244a260c435784f93e2c6374879ef657465035b734e4cb71870c53934923a653d2722
SSDEEP

12288:f9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5q+P32:943HfwIGYMcn5PJrZU+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
7a56a0ce7d56b961dd11492b4ec516ee

SHA1
8c1c2788e85a3af12ea658210d71e62c2cdf303c

SHA256
14b8fe9fd91ee2ee7b8dcf76a7761198085fe78b5ff21febaf956a5ccb99f0e7

SHA512
6fdc5777d175b14925c0b68d9a1e1be94dfa0bd0f3550f90da93a4091d59d7fe90144d756a240ef2414dd4ced65631713862b0e3cf627fb291f0350787626695

Download Submit