a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc.exe
Size 483KB
Sample260820-vt5krasapc
SHA256 a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc
MD5 b283acba0a5390e063b11a0a75fe0b7e
SHA1 3cedd86279d1c2811123e89e9e06a4812b934d85
SHA512 1ce19e12f17ccd7886d3bd4e3f8d401bbff6ef9493f88f7d1a03dc4e4f10953eb2889c32aee5eae84f5d1e607befe252278ebde2239656c815f6303b04e07dd2
SSDEEP 6144:4Tz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrhT4:4TlrYw1RUh3NFn+N5WfIQIjbs/ZXuT4
TLSH
T1FAB49E01BAD1C072D97514300D3AF776EAB8BD201835497B73EA1D5BFE31190A62AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3584	a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc.exe

C:\Users\Admin\AppData\Local\Temp\a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc.exe
"C:\Users\Admin\AppData\Local\Temp\a44a8db556aeabfcea65507b1668827fc628981d657efa20203936ac7ff449dc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 2462d63f972235a97e17e6ac75e548a829dcb027d1d47c96c615e6b3b627f5cd
MD5 892523cefdecaeec7cce8436c173efc9
SHA1 40bfbde155913755e73bda3bf442742b6939e09c
SHA512 54a18978114709ab88401532b3e3a272289ada44def16f50ec39cb4e41b1897d3bd5db8c6fdddfe8a79d310e9a0c831cfa561a43e58d4181f83d2184899bbfc6
TLSH
T1F4C09B5577D1101D7876F1E7D57700367A71FD55003DC80D11D2034C05F690515847D7
MD5 SHA1 SHA512 TLSH

Submit Download