7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RemCom.exe
Size 3.1MB
Sample260721-phrxmabl3x
SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
MD5 3e298792e73b58dd0b0d81f91683d9e0
SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
TLSH
T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemCom.exe

C:\Users\Admin\AppData\Local\Temp\RemCom.exe
"C:\Users\Admin\AppData\Local\Temp\RemCom.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcom.log

Path C:\Users\Admin\AppData\Local\Temp\remcom.log
Size 352B
SHA256 562387b8c146dc864e1c698892043d92802601b68e14663e893730c756964b6a
MD5 200cf6e94da7af3e2216dc42e33dafce
SHA1 85beccd16c809f8df0343bfdb6a630238fee2b86
SHA512 784c84adbfdd455a13c08f73a61b497c987ab04b201a72ea0aed5ffcd192e750195e882139b9b7e00327288992cdd6a1b46395b86c2ddf687f58202421ff36c1
TLSH
T1D5E0EC25E1F9BFC30D1D230210388AE89060F449320902B00069F6A8F61F89FE6927E0
MD5 SHA1 SHA512 TLSH

Submit Download