3de8f4665d1bb4e461bf24e88183326864a4e7f36cdf7383c65e86fe5df659c6

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe
Size

481KB
MD5

fd5ef7f25c7e0ae3ddf04b994d257665
SHA1

2b6c28c3ad4b06985a6b247b781da18e9210bcde
SHA256

3de8f4665d1bb4e461bf24e88183326864a4e7f36cdf7383c65e86fe5df659c6
SHA512

a2fc5b104d3b6d6aa44fd63799f8d0be3cb5da0f70148753cf659b4ccb1cbd6091a54cea6e0a368b4758c50cc40edcc3713f914881a70f9f3fc4b09d2158245b
SSDEEP

12288:ruD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSd+DY:u09AfNIEYsunZvZ19ZCs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
06ec13d87af0b2f881fd5394d237423a

SHA1
65f9516fc1a83d0952e87d95240a483c230cdcb4

SHA256
77b7e1ad83a13bcd6ac2a8ea6f82d092fcf0a8f6c377e8b6ca47dcb6fa413402

SHA512
c044369361af9ff87dd6aa8d6c8f3016d17ac1afb21f9c8f104aa93c224e2ad29f530f5c159908aab069fd0f5bdba44fc55bb8ba1720db1921578182da5e13d2

Download Submit