0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-01-2025 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe
Size

482KB
MD5

2494e0b05e93dac87d4143b7d2f163f0
SHA1

84c0fe16e08be20a5ea511aed0c030e9631d0b2b
SHA256

0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0
SHA512

984e6ace88dba4adbe81afe65d662af39cda7a98d36a610960df2cbf7401305778fdc514c88cbcd9d41cf7705ba5da12b663de235ad713870b5999db6409a5a9
SSDEEP

12288:N13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS:Hak/mBXTV/R0nEF76gFZH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2380	0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe

C:\Users\Admin\AppData\Local\Temp\0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe
"C:\Users\Admin\AppData\Local\Temp\0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
9037c1d9e67964f6f5c43a0cbb208f6c

SHA1
587fe35d0d785155c47928e83d37cced2ce21573

SHA256
6fdba213db24a64ae23e1b967ff18c68376f4f8b9ca976d254f9c69b3472f4c1

SHA512
6ae4ca5321bbaec720ecd8367e91641b32e7e148f3dcdeb9d6af616bf62cd45c4b1052fcca5ff1cbcacc27908cdef79474a8f6660e3adeb317a44f02f6feb834

Download Submit