a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d

Analysis

max time kernel
60s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d.exe
Size 484KB
Sample261114-y5bzcsvw7k
SHA256 a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d
MD5 7e54b63ebc3c0f050d460ac978236248
SHA1 448e3b2f85525c40bd388ed1df167cc1cfa0435e
SHA512 d241365976392a942b2ca25387f3dfd584f85d017e1805f1117bb4a97dcf314f8c31ef1f39dd872036aaaed868f70d276a8687d38bd74d4219688a72c4b53826
SSDEEP 6144:QXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNJ5Gv:QX7tPMK8ctGe4Dzl4h2QnuPs/ZDocv
TLSH
T1DCB49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3312	a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d.exe

C:\Users\Admin\AppData\Local\Temp\a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d.exe
"C:\Users\Admin\AppData\Local\Temp\a16fb08a184e2658dd31706f8f74424851c64107ea221e95c6523e1d720d1f9d.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 9271a569b3fb043cf363138bbdbcf25460d90f4cc2f9e9fcab8b1794059ee5ca
MD5 f2e0d563cc37ec5cdd5d0a3f3264c097
SHA1 1c4c19470c0c91556a3f8363c3b9f3e2d897ec69
SHA512 20d64ad146ede70d61ba78039cb3bb104d48b9251e8d0e039a51d66d482b1915eee1c731a6148e032ebca7e497c526f1669449ba4902889b8404ad1d23c8e82f
TLSH
T1F3C09B5A73E1101B7CB2B176557700353BB1FD64003CD40D11D2134C15F150021407DF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads