7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RemCom.exe
Size 3.1MB
Sample260721-phrxmabl3x
SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
MD5 3e298792e73b58dd0b0d81f91683d9e0
SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
TLSH
T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemCom.exe

C:\Users\Admin\AppData\Local\Temp\RemCom.exe
"C:\Users\Admin\AppData\Local\Temp\RemCom.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcom.log

Path C:\Users\Admin\AppData\Local\Temp\remcom.log
Size 444B
SHA256 a78225383ece955aba9498e16719383259782483c669bb5d09e77e63d214dfff
MD5 c87a630392d7c766fe97a58426ccf6fb
SHA1 ba8b91052917abbac224c8b1250aba32f2d1fa79
SHA512 5221625ef9a54bbae19cf5755cf39f82026356941c3b47376f8bc818ae725f5962df6b484a1623ae0a44ad8f8bd56850a288fc7bf114f77f5343f0c7319534f8
TLSH
T1B3F0ED7F66FBAFC70E5C230110789AE9D871354933CD1AA55169B482371F89DA6A07E0
MD5 SHA1 SHA512 TLSH

Submit Download