7f6883f6aafcdfa19d7da53c3d3efb5d55690b8a5b916c4a688d8204300a588d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_2b5dc8068a472eccbd3985dca06f035c_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.4MB
Sample260415-rxstkscs41
SHA256 7f6883f6aafcdfa19d7da53c3d3efb5d55690b8a5b916c4a688d8204300a588d
MD5 2b5dc8068a472eccbd3985dca06f035c
SHA1 b9e5df918ef4e106977f043364d8b9450bccdde5
SHA512 7b6fb3c07be63df2bdabc7db389362761b09357a64ca75989ca691cada5ee45b11fb7f9a7ba1bd80b26d2630597febf76ab1fa3c9a78d296b0a5c995e6d0a8d0
SSDEEP 24576:rqVYAvfEoym1uBv3eZqhae16CGbfxEXYGaKqM:rkYwZUv3eZqhaK6zbfqdl
TLSH
T1C4657B11BBE88072E1B3563589B6E317EAB5BD111B30CBCF1254A66E5F336C09A35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_2b5dc8068a472eccbd3985dca06f035c_elex_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_2b5dc8068a472eccbd3985dca06f035c_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2b5dc8068a472eccbd3985dca06f035c_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x000000002F131000-0x000000002F132000-memory.dmp

Download