f943e9d208d6ee61e7329e7673537df12cbd74a06c277424b23c4c5d87ab9641

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpbtpnplex.exe
Size 516KB
Sample260601-2lahzagv2w
SHA256 f943e9d208d6ee61e7329e7673537df12cbd74a06c277424b23c4c5d87ab9641
MD5 434a86657c42c324e59e025bce1a11f5
SHA1 04f65399b376530061058afa4363a3a3a7d102ce
SHA512 8682ea9e845cace066c5836d2eee55cda5093cff6e45fb4f3045119d04354633a1a7a5825cd5c0675f9ba222ab3ad0ff577dad1b8828af76aea08d4011cc1d84
SSDEEP 6144:NXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBceIS:pENlHV9FGeDWv3jADnyYiCNrsPZ03
TLSH
T193B4B001B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpbtpnplex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	tmpbtpnplex.exe

C:\Users\Admin\AppData\Local\Temp\tmpbtpnplex.exe
"C:\Users\Admin\AppData\Local\Temp\tmpbtpnplex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 e9664faeed03c7104bf6c0ef121652526d5a0ad71289960e6e86072fa86da823
MD5 e39c041f03261e1b4868953f327c244e
SHA1 3937a995cad9033832611707a09dd0dad1b59863
SHA512 e2246c697a4dfb42fc1e4917f187dab63d103542e9058428990c366e4c41768e5c8a583f8a96eb84a43eb75a6a5de9aa91dbd3b33445805a0a3da2a9dcedb35f
TLSH
T11AC09B9937D5145B7873739E547300393B72FD56113CCC0D51D2038C05F550015417D3
MD5 SHA1 SHA512 TLSH

Submit Download