5ae8af70cd0a3361b1b283fca571c21f466306ae29d700c90d5b3c0fa5327ead

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 1.6MB
Sample260604-pdhs6ae14k
SHA256 5ae8af70cd0a3361b1b283fca571c21f466306ae29d700c90d5b3c0fa5327ead
MD5 d646a0d7ee48db20e5b491aaec50ed9a
SHA1 71467bbf7865b5e36f9468bc80625219dc73c1a1
SHA512 6e15dc6d96c34653833dcb8ac8ba65b57112b82f2b2370d98a4ef77dba2950a4d5efd8d7571f6066dc3e224294b116f71fc3155adea89f709e4691ca601ab041
SSDEEP 12288:szR5tL/cZdR0HWnGT9QmtGBGwuH5D753MQzjpLRC++fiyST:szR5tLImWGTIGwup58mLY++fiL
TLSH
T13D85C43077E54075F2B22A7299B895548A2AFD994B38C1DFB18C1D1E3B7A981CD70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5376	installer0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer0.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 5376	6028	2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Users\Admin\AppData\Local\Temp\installer0.exe
  "C:\Users\Admin\AppData\Local\Temp\installer0.exe" /R /VERACC=1.1.69.0 /VERPCK=2.2.2155.0 /VERSEC=1.1.1057.0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AccountSvc640.msi

Path C:\Users\Admin\AppData\Local\Temp\AccountSvc640.msi
Size 150B
SHA256 faff54b2d7d5f3a9931e2cae6dc93b19df8b65fa0bc615b9dee822cb0142d3f4
MD5 c01511fe795d558d9c56f78310d408b7
SHA1 d49946d1ce218eb48626f9d130d5de3a2053c888
SHA512 af700b9de2c335dd0eb26b04bfd67b7895d36c3df971187acbb5ae36742b32c6035d58552f81c24cf2c648e63b6c67f8ac9e917ddfb0145906855fa98ee032f2
TLSH
T14EC08CEC6810944005E539112EA3B718241652E7A411AB4009C008727C2032E0D066C4
MD5 SHA1 SHA512 TLSH

Submit Download

installer0.exe

Path C:\Users\Admin\AppData\Local\Temp\installer0.exe
Size 1.6MB
SHA256 5ae8af70cd0a3361b1b283fca571c21f466306ae29d700c90d5b3c0fa5327ead
MD5 d646a0d7ee48db20e5b491aaec50ed9a
SHA1 71467bbf7865b5e36f9468bc80625219dc73c1a1
SHA512 6e15dc6d96c34653833dcb8ac8ba65b57112b82f2b2370d98a4ef77dba2950a4d5efd8d7571f6066dc3e224294b116f71fc3155adea89f709e4691ca601ab041
SSDEEP 12288:szR5tL/cZdR0HWnGT9QmtGBGwuH5D753MQzjpLRC++fiyST:szR5tLImWGTIGwup58mLY++fiL
TLSH
T13D85C43077E54075F2B22A7299B895548A2AFD994B38C1DFB18C1D1E3B7A981CD70B33
MD5 SHA1 SHA512 SSDEEP TLSH