0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe
Size

482KB
MD5

2494e0b05e93dac87d4143b7d2f163f0
SHA1

84c0fe16e08be20a5ea511aed0c030e9631d0b2b
SHA256

0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0
SHA512

984e6ace88dba4adbe81afe65d662af39cda7a98d36a610960df2cbf7401305778fdc514c88cbcd9d41cf7705ba5da12b663de235ad713870b5999db6409a5a9
SSDEEP

12288:N13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS:Hak/mBXTV/R0nEF76gFZH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4028	0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe

C:\Users\Admin\AppData\Local\Temp\0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe
"C:\Users\Admin\AppData\Local\Temp\0a9f71ca7bf09038bc2ca2eb7fb8ac99459fe64eb820f9dc996d88dda27e35d0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
ee29180874c99ed74a5ada0d12f35589

SHA1
0df7a1633118ef05866478dd468e5f9b3d98481e

SHA256
8b1ee14153cae5224473b957fc32ef14d19b89448998765c2dd8def2e35a6a37

SHA512
86cca0d0e99d931240fe55c7aa277dd96702c10afd7566321de43012139eca32ec1771f34b909266eaaa1a5824b38edeb580a6720eda4c8a3276617d616f9a2f

Download Submit