f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d.exe
Size 483KB
Sample260820-vt1a2avwhy
SHA256 f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d
MD5 e74610e567ddf8705affe3691f693f1b
SHA1 b9b1b50a229ca787d45d4f1fd96d4a1b3b37879e
SHA512 eb4229fe52ca642c3003943faa244260e9a135fc478ae4750458713114e8629e18f3c5e2f27a0a8bf6e77f5e355f76e4efcb0ee722117d0d363d77e560e445c5
SSDEEP 6144:AXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNu5Gv:AX7tPMK8ctGe4Dzl4h2QnuPs/ZsPcv
TLSH
T1C9B49E01BAD1C072D57514300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
560	f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d.exe

C:\Users\Admin\AppData\Local\Temp\f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d.exe
"C:\Users\Admin\AppData\Local\Temp\f574bb12afb6696c0cbb09b61d75cae1fb48843079e07cde53886be61ce5bd2d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 494056ec2e5b26d1cd1a1a9c92792be7c93c8b43cbb89ab5722ba32b0a79bcbc
MD5 08592aea098c2137392ea43efef04d40
SHA1 0afc5589fd8b77bd3d1b3c18ac98e7237ecc6fe8
SHA512 ee86e587711dc2212c96f4c091e366cf51fd134ca2612c07d81d637e1105af10b530b7146502967dbb6f00834a52ea552157dc61613e5c8bc86d80fe438506ac
TLSH
T17DC092AA77E1141EB872F2EBD5B700363A72FD6A003CC80D21D2039C19F7A0621847D7
MD5 SHA1 SHA512 TLSH

Submit Download