311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe
Size

481KB
MD5

fa48843ce9a50a4bc84f6996923b7a27
SHA1

29df9451a5aae33ddca11c26163d1c276bf2ca65
SHA256

311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7
SHA512

d1f1d6b6268bf020319ca282483df3b8c05f28993f88faf04b0d26c4db5244a260c435784f93e2c6374879ef657465035b734e4cb71870c53934923a653d2722
SSDEEP

12288:f9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5q+P32:943HfwIGYMcn5PJrZU+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3800	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
c1052838a293b6a29767a0c905e9509e

SHA1
929160fde62b2a0127b09f34be9ca2b99e9926ab

SHA256
7b02d5ec9a7fcfd08a2764633bfdc8e9ee2d4224126dbf4e1001bc8ffea1da57

SHA512
e46459ebabd0f2c8c24ad27b14a3cb31a3a488267fd5983d33caaa28dc26d02ca0f78363c865b4084a3aea0a44282b4e993d63178705fed3747c2412ce620ac9

Download Submit