9c08fac5208b8d654e48b347d4f05ead798413e933dbb755e10eb73eef006cf4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_b2847cd248df173e14912d3f70449e17_coinminer_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 483KB
Sample260823-cpe57asakd
SHA256 9c08fac5208b8d654e48b347d4f05ead798413e933dbb755e10eb73eef006cf4
MD5 b2847cd248df173e14912d3f70449e17
SHA1 1019b5b7743a78c21a1e0311062441b8cf366273
SHA512 9a142568d8f3c6c63ad2c587be68a8433a3a2c2bcecd2b8cfb19eb33fda14ea34caae702740e1cd7d573a110f614e05c467276067364ec76ae2b5eefa7f3bdf7
SSDEEP 6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNT5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/ZsScv
TLSH
T1CCB49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_b2847cd248df173e14912d3f70449e17_coinminer_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1612	2026-08-22_b2847cd248df173e14912d3f70449e17_coinminer_elex_luca-stealer_mespinoza_njrat_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_b2847cd248df173e14912d3f70449e17_coinminer_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_b2847cd248df173e14912d3f70449e17_coinminer_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 af452afdf249d0e79bea9beab0626a01848f190c053d507804dc01c20d249e3f
MD5 e58e62623b1130b1a8357f9d416e7277
SHA1 3d7c0e3c511278736b62abf3f377c3d5392e897b
SHA512 79e6747b9a2e228792841c32115b37f71fb1b7de7fb8e48fce65abf69387e69d417327530cba72e663c3e9a68eed27628c22d39987acca058ed0adf57290e0fe
TLSH
T1B9C09B5977D5145A7876B25694B300357A72FD55013CDC0D11D2034C05F55052140797
MD5 SHA1 SHA512 TLSH

Submit Download