0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0

Analysis

max time kernel
147s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/01/2025, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17371540849d55321508f5d6bb477d79818e71faf7e18767f16ffc57ce2721f8b2fe57440f910.dat-decoded.exe
Size

482KB
MD5

2494e0b05e93dac87d4143b7d2f163f0
SHA1

84c0fe16e08be20a5ea511aed0c030e9631d0b2b
SHA256

0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0
SHA512

984e6ace88dba4adbe81afe65d662af39cda7a98d36a610960df2cbf7401305778fdc514c88cbcd9d41cf7705ba5da12b663de235ad713870b5999db6409a5a9
SSDEEP

12288:N13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS:Hak/mBXTV/R0nEF76gFZH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17371540849d55321508f5d6bb477d79818e71faf7e18767f16ffc57ce2721f8b2fe57440f910.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2316	17371540849d55321508f5d6bb477d79818e71faf7e18767f16ffc57ce2721f8b2fe57440f910.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17371540849d55321508f5d6bb477d79818e71faf7e18767f16ffc57ce2721f8b2fe57440f910.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17371540849d55321508f5d6bb477d79818e71faf7e18767f16ffc57ce2721f8b2fe57440f910.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
94f36959c96f7d5b943a212508dacca9

SHA1
892bb5f645e4a137fa6b2599bece641bd2176b7a

SHA256
0ba68641613f106e574f94bdc7900f9a02e4c0a328a48e8d251949582eadf85f

SHA512
5547d46fd25fd6564bb94e8c891e7226eaa31af227cd5885bf774146738f32a01d2cb6a95aa044e0f86d3b1ba061907b99bcbc729ea142c5ac4fe5f292280a06

Download Submit