62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-01-2025 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe
Size

482KB
MD5

84d5ac61373303f412797236918188e9
SHA1

3873be598442d8d0b88015b0403d2b351868c32b
SHA256

62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b
SHA512

8d5ffda2fc9b9a235be70a5762ae45b366a0f7cbd1aa57204f524caca6ee8bd5185ff964a69a1fa52b1fe34b47767cd9d3632208928d60b7458d5e168e8a0044
SSDEEP

12288:513ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ8S:rak/mBXTV/R0nEF76gFZn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1604	1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
86c85045d3832d8a14727fc968040530

SHA1
09cfa46da8ae3ffa3041ce40736fc4bbb044610d

SHA256
f6772dcafe476c361c55f334334cf3a8ee704712d63731ad6605aeabe9503761

SHA512
6c20b8f5af7a2139ccb5a23cd83ae2152b52bfab55ef70292043549553648baf0ace344a2b6d2838e37d1d0ca5d3302d58b8fd572d6245917a9c8f2f1fabf589

Download Submit