311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe
Size

481KB
MD5

fa48843ce9a50a4bc84f6996923b7a27
SHA1

29df9451a5aae33ddca11c26163d1c276bf2ca65
SHA256

311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7
SHA512

d1f1d6b6268bf020319ca282483df3b8c05f28993f88faf04b0d26c4db5244a260c435784f93e2c6374879ef657465035b734e4cb71870c53934923a653d2722
SSDEEP

12288:f9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5q+P32:943HfwIGYMcn5PJrZU+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
396	311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe

C:\Users\Admin\AppData\Local\Temp\311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe
"C:\Users\Admin\AppData\Local\Temp\311df69d6714a0736be9908da11fa4c544a542ba4f9c99a314e727b321a80cd7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
c1a16ca44104f425e30fc3bac47e7588

SHA1
e15c39c368a2a96de7945b44f2d1641f1fa18b5e

SHA256
20067bd5e52b3cc08b2f769ed78b897e2594b73b0e0b2f3221a446397ee909f0

SHA512
5646841f6eda640334c256607492021911034ce707d167fb2a1d607723f414bfcae40614b6347b5e5ed8bce5002c64e0d48adc3169553ae23df2257a577c8443

Download Submit