7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RemCom.exe
Size 3.1MB
Sample260723-w22phahn4x
SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
MD5 3e298792e73b58dd0b0d81f91683d9e0
SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
TLSH
T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemCom.exe

C:\Users\Admin\AppData\Local\Temp\RemCom.exe
"C:\Users\Admin\AppData\Local\Temp\RemCom.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcom.log

Path C:\Users\Admin\AppData\Local\Temp\remcom.log
Size 352B
SHA256 036b4763741c93f76e3dd0426a36de0f14644a66bc10fa6eca355c293eafbc01
MD5 debd73b2629d0d6d4989b229614e175d
SHA1 ede7d617ccb0eb38c0d63c63be14ddd11a93080f
SHA512 af6767cd0ddcf1b8d692af5ffa516f904b73039d81e730301ef3078c9ba3274eb661f02c689b3d9357508c9ef9e6fa1ad866dfbea98b6d0aca5a589df42ba619
TLSH
T1CEE067A546F5EFC7097C570318789AE9926D2841618F8DCA3069F481372FC9FE7E0362
MD5 SHA1 SHA512 TLSH

Submit Download