Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_5620bf4cca5f4b4b1c101bdc94a8cf25_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_5620bf4cca5f4b4b1c101bdc94a8cf25_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Resource
win11ltsc2024-20260706-en
1 signatures
150 seconds
General
- Target 2026-07-06_5620bf4cca5f4b4b1c101bdc94a8cf25_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
- Size 3.8MB
- Sample260706-1de8tabx7y
- SHA256 bab55339e858422c35382df2da586bf57d19f8aedbde7cbd7093cb58aa4f16df
- MD5 5620bf4cca5f4b4b1c101bdc94a8cf25
- SHA1 2acc684145a6b0517d6c98d5541c5ae2c6c683ca
- SHA512 b5eed8619b4eb2d0741af7bc5db42157b0d2c8b7630d178361de1ac93dffc44d172d0b7926455bc14ff82e9e819277658c774dfa524e4b8448d2282da0610a01
- SSDEEP 49152:w/BF3ru/dVauwTjH8MIhFvzxekwWveJrISYAbnA6bRyFEub2tkrFs:IcMypwkbyc6bRNub0kr
- TLSH T15406D02179838276DA6241718F3D5E39A45CBF21073585C7B3EC2E2E18B26D35E723A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_5620bf4cca5f4b4b1c101bdc94a8cf25_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_5620bf4cca5f4b4b1c101bdc94a8cf25_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_5620bf4cca5f4b4b1c101bdc94a8cf25_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2372