eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe
Size

482KB
MD5

e27c32776702de27eebe7c57d9f588c3
SHA1

53d540479ae70df2a8fa050c5a242a1025fbe597
SHA256

eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a
SHA512

379d8b178d0642c679ca619845d19bd5ff340f7bb5dd2c279278855c953f3547776d31b826ae0bf0b4527baaaceb61bbefb297890a5c173d8524e19bcf63091d
SSDEEP

12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQwS:jak/mBXTV/R0nEF76gFZH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2348	eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe

C:\Users\Admin\AppData\Local\Temp\eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe
"C:\Users\Admin\AppData\Local\Temp\eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
49df5e9d5835762d5768fafadd7366ab

SHA1
9b2ddad51a0f260fb27b933d9a4002031aa3449d

SHA256
9fa0ee5fc6f465216e178e03b10b5e4d88fa9e0994ef68836061e98727b59593

SHA512
52f65fb51add602874c66778f1a65cbf7b8037a6bade2f99794a976761c8187acc5f4d19f425eeae3245bafa56b893a089413765896b95faf3b87aa65c6e11a4

Download Submit