a4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xa4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8.exe
Size 483KB
Sample260604-yrbfnsdw8t
SHA256 a4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8
MD5 dfcd19ca1847b3b51e3ea26ecd94fd19
SHA1 bffc5618ddaedef4b8e25622221b2a15d66971cc
SHA512 9be7794039ee726bd5a0ef6f9540c7c2412bb6465e4f42c6cc23df60d18e95f0aab142bfb2a899def2c564dd09e15fe7bbb2670f55c357d4e7beea81aa6ef381
SSDEEP 6144:4XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHPsAOZZDAXYcN75Gv:4X7tPMK8ctGe4Dzl4h2QnuJs/ZDmcv
TLSH
T127B49E01BAD1C072D57524300D36F776EAB8BD2029364A7B73D61D5BFE30190A62AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xa4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	xa4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8.exe

C:\Users\Admin\AppData\Local\Temp\xa4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8.exe
"C:\Users\Admin\AppData\Local\Temp\xa4ded11d5ecfbc79a18c8a36da4fddf58f2b92a55858e5510f232ca03353d4e8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 f069c92054129ee374fe10e790a54eec73606c3058986c8aa8dc460aff82c050
MD5 5c05d5944321bd86bb62e90bed9516b6
SHA1 b1e3df1b96583febcbb8ab7f8c0ef4aef1c59b1b
SHA512 9a1d26beab735fa03a816c80edcf3e9a9a5ca51dcff8435c1b1687fd5ebb604bfd3ba21444622c1feddbf316642269f319c0b51297d3a60f442ba4872a7e8c6e
TLSH
T14AC092AA73E5141F78B2B2AA98F300373B72FD64213CC84E65E2038C09F5A0061857D3
MD5 SHA1 SHA512 TLSH

Submit Download