8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-02-2025 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2.exe
Size

482KB
MD5

72351686e502b31b3649f3b0b8f84331
SHA1

50a3f1220ccd0b7cea5e3333c5aa59d4ecd7681f
SHA256

8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2
SHA512

e5268e9593fc84727749bab82380a2a9e845463bea1c577af9a688e067e8f4aba6fce4fb02c79229570c0bbb77e293e3682065436b97c327104d66888037ab3c
SSDEEP

12288:913ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQNS:Xak/mBXTV/R0nEF76gFZ2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2372	8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2.exe

C:\Users\Admin\AppData\Local\Temp\8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2.exe
"C:\Users\Admin\AppData\Local\Temp\8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
8f07444716167a6592e83ff8ef78cb96

SHA1
60c26891e97bda9e61f9e8d1f25834c8d6b96d75

SHA256
4bb211f736a6b2e6829a83261e5a7e3de2523ddc4fcf6880534437a22847db1e

SHA512
d59627f93a628a432927967875c05f67a6e0f2c2f9302ab87b6e454698e60a79b4cc8af7ac773233665e6cb1d194e69f370839b2c618ed7d89d64564ee498b38

Download Submit