62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe
Size

482KB
MD5

84d5ac61373303f412797236918188e9
SHA1

3873be598442d8d0b88015b0403d2b351868c32b
SHA256

62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b
SHA512

8d5ffda2fc9b9a235be70a5762ae45b366a0f7cbd1aa57204f524caca6ee8bd5185ff964a69a1fa52b1fe34b47767cd9d3632208928d60b7458d5e168e8a0044
SSDEEP

12288:513ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ8S:rak/mBXTV/R0nEF76gFZn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
220	1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1738015626114267b619efc89e7bf70f9ca480a3184e7d6d7374ec319efed259b53c4e9134513.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
d33c95b08c7877a048b287d81db606f9

SHA1
065dae96443842e2a123e73ff5bf621e495280fa

SHA256
00ea5518a6d29bd1ba6004bc34b2b47548fafc980724ea33b67f404ab55ffe94

SHA512
3f87fb94b7b62b1229cdd8a545c00a738e274762593d1804e6f296eebff9e3b68926081c4e4a6b607edb34024a78446e258e7aa254ec036d19f5bab84c9677d4

Download Submit