62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2025 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe
Size

482KB
MD5

84d5ac61373303f412797236918188e9
SHA1

3873be598442d8d0b88015b0403d2b351868c32b
SHA256

62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b
SHA512

8d5ffda2fc9b9a235be70a5762ae45b366a0f7cbd1aa57204f524caca6ee8bd5185ff964a69a1fa52b1fe34b47767cd9d3632208928d60b7458d5e168e8a0044
SSDEEP

12288:513ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ8S:rak/mBXTV/R0nEF76gFZn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe

C:\Users\Admin\AppData\Local\Temp\62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe
"C:\Users\Admin\AppData\Local\Temp\62bf96d96e1e13745ff9f382a49449fe7769022e1b1071527e7ddd5f11fc1e9b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
1cf4d7d55fe2fb6a8ba45919345f3443

SHA1
f85143c09fee8c91a8d47c618c5265adb8433d08

SHA256
8a23cb019cd4ae23c3463f0cc26a56329334a7c0e1619fce54ad1bd8a0849a55

SHA512
eb9eaad62273993358a0ee582923574f862c11168f5b2e98983ffa25f7963dc0633a81eebb094a2a4df33631fe9405107f2fe88958ef1fa905de936e5b8ad55f

Download Submit