c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/02/2025, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a.exe
Size

482KB
MD5

46f8b282dc54f495a237a71665eb8cd2
SHA1

7b432d7160c156a6a662f2cc5d74c535f279bd54
SHA256

c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a
SHA512

8009f5609d5f23e23d4f911981cb1c52401d833cace0f7cf442c2f09229242bac07fe220ffeda68b82d0f1f1a0cf06adbb202f59bc221224a1152bc351c25e21
SSDEEP

12288:N13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQtS+:Hak/mBXTV/R0nEF76gFZyH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a.exe

C:\Users\Admin\AppData\Local\Temp\c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a.exe
"C:\Users\Admin\AppData\Local\Temp\c3d267d6ba22fb3fe1ea8df01275331e006006e280ba6d746bac520c8476745a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat

Filesize
144B

MD5
5e3a722bac443294a0b09ac4fbb9579d

SHA1
442a6824a194a57c47c081a0d6bf43ade36b32b9

SHA256
d3c63efcc4a6d83787548aed626ebbd90ee0d90ac501afe6bcd1291ccb93baa4

SHA512
ec11054c0c0456234d9ef73e7a3defde04ad788806fe636f9173429ca6b2060f7d9373a93b4afd11e476f2403a02d19df3d79cf39a91a6f5e910681a9e2e2d60

Download Submit