311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-01-2025 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe
Size

481KB
MD5

fa48843ce9a50a4bc84f6996923b7a27
SHA1

29df9451a5aae33ddca11c26163d1c276bf2ca65
SHA256

311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7
SHA512

d1f1d6b6268bf020319ca282483df3b8c05f28993f88faf04b0d26c4db5244a260c435784f93e2c6374879ef657465035b734e4cb71870c53934923a653d2722
SSDEEP

12288:f9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5q+P32:943HfwIGYMcn5PJrZU+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2316	311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe

C:\Users\Admin\AppData\Local\Temp\311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe
"C:\Users\Admin\AppData\Local\Temp\311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
fcbd530e2e415a9d40699755c1418413

SHA1
e56020a8670fbf64867d2cfc38ffada299afe698

SHA256
bc218cee91abfc813055d9f2eae886cb4c187633b9c0e7dd24b814651a192698

SHA512
1ab7138f9335ad85a8ae784fe82097c0bf9bc5ab2ba2d40e89472724757a425a250585bb642ce600d39553c2ef2e6396333c5e557616cc814fbe395f1e240d5c

Download Submit