eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe
Size

482KB
MD5

e27c32776702de27eebe7c57d9f588c3
SHA1

53d540479ae70df2a8fa050c5a242a1025fbe597
SHA256

eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a
SHA512

379d8b178d0642c679ca619845d19bd5ff340f7bb5dd2c279278855c953f3547776d31b826ae0bf0b4527baaaceb61bbefb297890a5c173d8524e19bcf63091d
SSDEEP

12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQwS:jak/mBXTV/R0nEF76gFZH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1536	eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe

C:\Users\Admin\AppData\Local\Temp\eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe
"C:\Users\Admin\AppData\Local\Temp\eecc7116c5730d44a829ee1e1d91cada1e9deb98122b358503e493aa5e60087a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
81b95a5d74b993eaf4e1eba4454b81cb

SHA1
a5d5f0bfca875b79b1d3bc9e51819283d34c1f02

SHA256
1d35da670e91d758ea97572c067af7d02c33fffa12254015d55dad344c614eda

SHA512
82c1db9df2fc1480839845a504bb0e9057a3e2c444fff9920cbbdfc62cda80f70dfc0ad1ae74d6bd6e4c4922a6a6883732644ba1741474a7bf1ca5d1ed57c58a

Download Submit