2b60f09ca9aa1e3772a621d2dd2ec07a6357a05d12b0490a4c8850c1ac4fbf17

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_f2649720c21512ffddbcbef4331ba8f1_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
Size

487KB
MD5

f2649720c21512ffddbcbef4331ba8f1
SHA1

ac7cabd38bbd3680c14c1428f0f82cb696b6fea9
SHA256

2b60f09ca9aa1e3772a621d2dd2ec07a6357a05d12b0490a4c8850c1ac4fbf17
SHA512

a154d97bcf8a6a875dccd7f56e2734db3c764ace912aba5b487c273afeec25264b125dc13be9340c82d59bd75648809554426f7c19896a97c676a1c2a5d81e12
SSDEEP

6144:iIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZ/FXvXc6wJ:i200OFp+G0imvHn3Cp6qyBP+YdsvZ/m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_f2649720c21512ffddbcbef4331ba8f1_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3380	2025-04-04_f2649720c21512ffddbcbef4331ba8f1_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-04_f2649720c21512ffddbcbef4331ba8f1_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-04_f2649720c21512ffddbcbef4331ba8f1_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
e5fecb23bcf1edb9da66adb10cf316ef

SHA1
658f0e33e4c7d064c7e12cdcd6063ae9035c82d2

SHA256
149277ebf94412776b40741dec721a568018a1fb1cb896ae3e8cc309dc3e8e56

SHA512
77f67ddcb8e2ad1d6185edaf3aba471c50964ba81e6877b4f8b4e2bed61cd8eca0912289f9cc34df97668f21466fcaf78503e19b997e8b01de9326c474fa8def

Download Submit