d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17364916858196b8cf3ca6bc3e069a3e8e9b4a974f8245ed13fdd20678ee3616c5a95c5000575.dat-decoded.exe
Size

481KB
MD5

4a17a8d2df7c866fbd37655a20223bce
SHA1

c8f9a96c5d190ff85387e21ad1a718f7893ae622
SHA256

d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c
SHA512

07c2b3110806b9220cac20bff8b7406ee62dc19b0beea4c597562a22f87d9b1e0798106f2ef87f8aa1222b512a0bbec63cdd6e21edf8144f2f5f5c446424629e
SSDEEP

12288:ruD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDS1+DY:u09AfNIEYsunZvZ19ZGs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17364916858196b8cf3ca6bc3e069a3e8e9b4a974f8245ed13fdd20678ee3616c5a95c5000575.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	17364916858196b8cf3ca6bc3e069a3e8e9b4a974f8245ed13fdd20678ee3616c5a95c5000575.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17364916858196b8cf3ca6bc3e069a3e8e9b4a974f8245ed13fdd20678ee3616c5a95c5000575.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17364916858196b8cf3ca6bc3e069a3e8e9b4a974f8245ed13fdd20678ee3616c5a95c5000575.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
8c044ac33b174e9caf55b1a4347ee81e

SHA1
a0e763784fdd6ec047aecf9067cf2ca013521581

SHA256
612f9bf6b3d630260e91f3a6eea8b4b0b070a71128c722a3295684107ccd349a

SHA512
c105453e472141e5a6a67026941894569c9191156c6a31d274281bcccf4467f67b6bee06eb232b38885a41270a0492f86a5f7d4d0000c4f7ff20cca7d4736dba

Download Submit