d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c.exe
Size

481KB
MD5

4a17a8d2df7c866fbd37655a20223bce
SHA1

c8f9a96c5d190ff85387e21ad1a718f7893ae622
SHA256

d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c
SHA512

07c2b3110806b9220cac20bff8b7406ee62dc19b0beea4c597562a22f87d9b1e0798106f2ef87f8aa1222b512a0bbec63cdd6e21edf8144f2f5f5c446424629e
SSDEEP

12288:ruD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDS1+DY:u09AfNIEYsunZvZ19ZGs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c.exe

C:\Users\Admin\AppData\Local\Temp\d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c.exe
"C:\Users\Admin\AppData\Local\Temp\d5ab553077edb632186fae2823dc664396267b4d40ac6fae4d27569be21bf03c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
6b45fe01de412e30be91657148519005

SHA1
7b61b88f7817ba5c4ad7378bdb2c930e336f12e3

SHA256
0fc05178933cc39cf0f8dd04008235fc291b195f6f94952a7ac6a4bbe29215e7

SHA512
4f2ccf87f7e99ef6a4fec559d8f2d37c21d4e644cff06af2e3625d2839a2d419270c3e9d297a6a444c41c168d2ac35255778b5deedc9d7aebfd3c9ad2734423c

Download Submit