c64be040beacfa41be4b8280b4b02a7cfd5d4d81a75bc94e81d0848b7baa2f4f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe
Size

481KB
MD5

ea495dd5eeb51bc22024728189eec9f5
SHA1

16a1cfe7a570d466ac4ee04ccc1cb0e99a3d7f1d
SHA256

c64be040beacfa41be4b8280b4b02a7cfd5d4d81a75bc94e81d0848b7baa2f4f
SHA512

5f5a197b959a76627617afe71d6cc10a82e4db283a3e06e1c4ec036b7a530800d4e2f899cba87090cc389fbe11b78ed6e1b8e42175e11bbb8da9e947a1e5f7c5
SSDEEP

12288:L9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5Y+P32:Z43HfwIGYMcn5PJrZq+

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1532	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1532	2420	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	32
PID 2420 wrote to memory of 1532	2420	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	32
PID 2420 wrote to memory of 1532	2420	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	32
PID 2420 wrote to memory of 1532	2420	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	32

C:\Users\Admin\AppData\Local\Temp\17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pymrgnu.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
80fef2cd920672e0b8c930ba768cf933

SHA1
fbe02060b347cd0bceb1ce18e3d319f57d53d5bb

SHA256
4bf04b00899b28c42df8914af72a676729ecac52575f0cbc52c97930170b1279

SHA512
57bc5d1c0601bc7619048b421f587fb05bc19e8f33fe50344ba1b5a563c75796de0dd2c7b343660c05237336c216960b9212ef9564f9997bfa924b6b46c41491

Download Submit
C:\Users\Admin\AppData\Local\Temp\pymrgnu.vbs

Filesize
828B

MD5
8b72bc0153f61bc00f5d60333a663959

SHA1
03e812556c8ba49ad182d689ebed94a95b10d5aa

SHA256
1ccf0bc9d0a553757b7c73783bec86cc5693172e64af3b9abc8632f3f62b9c0f

SHA512
6cf5fe23c9c31766dfd58ce7b91f123d0d4c8839a571c29053082d984a21fddc67c990f3af7c1df14a65718e99329e063d7d94d022abef2356e15a331f017a58

Download Submit