423a9551af1bbcc9e95c7655af088f871a78e194da44bbc72d7d03e5d544386f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0baced2409b52ccabba9a7e0c6d077f9_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 481KB
Sample260815-jvsf2asbrh
SHA256 423a9551af1bbcc9e95c7655af088f871a78e194da44bbc72d7d03e5d544386f
MD5 0baced2409b52ccabba9a7e0c6d077f9
SHA1 a398a6d4b2cab56237abe174d673946a141c2fba
SHA512 8f22535ce82543737b56342093bb3c9871de0f85f23656035250ccbf7d0044c945c8fb01d51b14d30d2991a6d0c761d1918a8267437a9f5a9dc8be9916261aeb
SSDEEP 3072:WBF5zkYMh343U9fnki50S7vZD0c7jg7g/a/JzGt3mPyePS2Ve/kDeX38wAg0FubF:WBvK8Khocg5/qePm/5AOG4TQO4Pc
TLSH
T18CA4D998282CF230DB75637367B50E64F4887019F62B2CF3D7819A849E18D917F694BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0baced2409b52ccabba9a7e0c6d077f9_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	2026-08-15_0baced2409b52ccabba9a7e0c6d077f9_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2692	2026-08-15_0baced2409b52ccabba9a7e0c6d077f9_elex_luca-stealer_mespinoza_njrat_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0baced2409b52ccabba9a7e0c6d077f9_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0baced2409b52ccabba9a7e0c6d077f9_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 348B
SHA256 5063ada9e164e4a9bb98cec04160551d86241ef63d9dc638822039406398fe62
MD5 f55d8ba572da81bd7de738fe0a5e7d3f
SHA1 5c768b0fc6ffcc269663a6b1d103e5fa11f75c64
SHA512 d963c7e667310e4e7d541e918e41316562a1c7948477dfffab476efa9ac9e92ae75dea71971702660f04c6132ef3181f7f02e9b5befc258456fbc5c1113d305c
TLSH
T1ECE02D800E002842E076E4ACF8A71BC0E0AAF00F88C19074FF2846DE1ABC42D22E8A03
MD5 SHA1 SHA512 TLSH

Submit Download