d640c1938939722229e8d80d909343cfffa58b0160dc854d1da6eb55e3840a2c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2025, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-17_9a7c80e6b3c52e69a87de8273bdd61b7_amadey_black-basta_cobalt-strike_elex_luca-stealer_remcos.exe
Size 482KB
Sample250718-bctx5svsgv
SHA256 d640c1938939722229e8d80d909343cfffa58b0160dc854d1da6eb55e3840a2c
MD5 9a7c80e6b3c52e69a87de8273bdd61b7
SHA1 8a856fadabbb6d47c99bca3dba9c4e1c9ffee9a1
SHA512 aff7d561fba08e1be977062a0df6b86a32114e5d184f41324fe506885eb44131130dfb7edb1b313d4e51787d2490af00d3e10724f54ed299b18009b3952e988a
SSDEEP 12288:FuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSc+DY:o09AfNIEYsunZvZ19ZXs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-07-17_9a7c80e6b3c52e69a87de8273bdd61b7_amadey_black-basta_cobalt-strike_elex_luca-stealer_remcos.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	2025-07-17_9a7c80e6b3c52e69a87de8273bdd61b7_amadey_black-basta_cobalt-strike_elex_luca-stealer_remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	2025-07-17_9a7c80e6b3c52e69a87de8273bdd61b7_amadey_black-basta_cobalt-strike_elex_luca-stealer_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2025-07-17_9a7c80e6b3c52e69a87de8273bdd61b7_amadey_black-basta_cobalt-strike_elex_luca-stealer_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-17_9a7c80e6b3c52e69a87de8273bdd61b7_amadey_black-basta_cobalt-strike_elex_luca-stealer_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\windows64\logs.dat
Size 144B
SHA256 89e8ffec62c292dac96c7738f70c1aa1e3e13407fe12a16cff7b4f23b6879923
MD5 2d939a8f9b512ec215e3787f40206226
SHA1 8ce818a6157a387a5ce78f13d806cf841be41d65
SHA512 dfad01921f313723b30c2d4d6b47adca0f9c11033b8c68ef8c04b12704e5824157322cec47a58bfc274338873ee24c7ca3c5b8f176178dc3c2f5af448ff5544b
MD5 SHA1 SHA512

Submit Download