c64be040beacfa41be4b8280b4b02a7cfd5d4d81a75bc94e81d0848b7baa2f4f

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe
Size

481KB
MD5

ea495dd5eeb51bc22024728189eec9f5
SHA1

16a1cfe7a570d466ac4ee04ccc1cb0e99a3d7f1d
SHA256

c64be040beacfa41be4b8280b4b02a7cfd5d4d81a75bc94e81d0848b7baa2f4f
SHA512

5f5a197b959a76627617afe71d6cc10a82e4db283a3e06e1c4ec036b7a530800d4e2f899cba87090cc389fbe11b78ed6e1b8e42175e11bbb8da9e947a1e5f7c5
SSDEEP

12288:L9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5Y+P32:Z43HfwIGYMcn5PJrZq+

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe

Deletes itself 1 IoCs

pid	Process
1904	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1904	4996	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	99
PID 4996 wrote to memory of 1904	4996	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	99
PID 4996 wrote to memory of 1904	4996	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	99

C:\Users\Admin\AppData\Local\Temp\17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\awpdnxpkchqmtlkbbjxcj.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
72c8e99584125e387f81f0f452452367

SHA1
d9a63161c08ff261326bf5edd0df6bd45a1e466d

SHA256
d1a259424bd74d12e2d7ac7a8d9915a98c1dfefc811fb5e700530984a9d112dd

SHA512
9dce212cad6ae7ed654abc620face14e4e51cbd80b734faed1cf5b4865cfc2affa700ed7ce42706916c2b104757cbc0404fc9beabbfb74ed0ab529a939cb25e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\awpdnxpkchqmtlkbbjxcj.vbs

Filesize
828B

MD5
8b72bc0153f61bc00f5d60333a663959

SHA1
03e812556c8ba49ad182d689ebed94a95b10d5aa

SHA256
1ccf0bc9d0a553757b7c73783bec86cc5693172e64af3b9abc8632f3f62b9c0f

SHA512
6cf5fe23c9c31766dfd58ce7b91f123d0d4c8839a571c29053082d984a21fddc67c990f3af7c1df14a65718e99329e063d7d94d022abef2356e15a331f017a58

Download Submit