b7f785c9c4b4547589a97de27b1693d99fc37d96795ed372aa59ced3ce7de609

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_41063c7e3465a364dcb194c6106d9a3b_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 274KB
Sample260730-ag438svglb
SHA256 b7f785c9c4b4547589a97de27b1693d99fc37d96795ed372aa59ced3ce7de609
MD5 41063c7e3465a364dcb194c6106d9a3b
SHA1 0296a648affa0ad1c281ada6cdb7f185499452a1
SHA512 46862590198343f4178413fafccfb5cb2109f86aa3859bf836252d2e580232906052669ed3daef15643367b4a4b7166434ec3c37d22a3fca39873ec3843f66d8
SSDEEP 6144:t9lHZSpxJs2vltVOQYxsFJAOHnMorVub:vlHZSpbvltVO5kJxn5Zub
TLSH
T169549D21B5E1C476D573093208F9A7B5567DBC304E3A8A3F63D41B2E9E30593AA31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_41063c7e3465a364dcb194c6106d9a3b_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3368	2026-07-29_41063c7e3465a364dcb194c6106d9a3b_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3368	2026-07-29_41063c7e3465a364dcb194c6106d9a3b_elex_luca-stealer_mespinoza_njrat_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_41063c7e3465a364dcb194c6106d9a3b_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_41063c7e3465a364dcb194c6106d9a3b_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 351B
SHA256 c5377dadf03f5ec48827f7e2ccb01d20a0548ff4362fa1352f15cb8c95325ae0
MD5 7ce93a781aecab19da22194b99b6e9d6
SHA1 4d42350795b36e505fbdfc49758d473d473cf6c1
SHA512 033bbb2fede5cd08aac7adecd63a63e3fefee388f9c351f71608be881e50136205aa5ee649b37e62d0ebe5542585d59fcd013725df74f73bdcfd187eba327b88
TLSH
T1C6E0285005003593A066D474FC610FC1D1EEF05D84C050B5FF54418E0DAC01C52D8603
MD5 SHA1 SHA512 TLSH

Submit Download