62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe
Size

482KB
MD5

84d5ac61373303f412797236918188e9
SHA1

3873be598442d8d0b88015b0403d2b351868c32b
SHA256

62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b
SHA512

8d5ffda2fc9b9a235be70a5762ae45b366a0f7cbd1aa57204f524caca6ee8bd5185ff964a69a1fa52b1fe34b47767cd9d3632208928d60b7458d5e168e8a0044
SSDEEP

12288:513ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ8S:rak/mBXTV/R0nEF76gFZn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2268	62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe

C:\Users\Admin\AppData\Local\Temp\62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe
"C:\Users\Admin\AppData\Local\Temp\62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
6398621b2667b86a9f41b3bf20fb4dde

SHA1
d3bf22775aa1fe0ee9c7a6c3e28e373314a71759

SHA256
a0d7ed590c4c4fae1b0e1e290accf3bac52400655cc960cec6994ff51d9cdcf3

SHA512
474778fd5cfbfd153ce8c136ec8dabe10801fa6f6e42f5c73f027a07b4c430df664fd5edb0b6a7168af50b2a3c9b4e5ebc524d4ec2642f213c392ec3d4a5a6c4

Download Submit