Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-23_d78fa49e9c04e3f431e7852bd7f10c85_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_d78fa49e9c04e3f431e7852bd7f10c85_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-09-23_d78fa49e9c04e3f431e7852bd7f10c85_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
- Size 2.4MB
- Sample260924-beew1aae33
- SHA256 488415a15413a73a0983183e340116374fa3556ac0f7951520355ec3d8659ea1
- MD5 d78fa49e9c04e3f431e7852bd7f10c85
- SHA1 888707e9355401175fff256605a8d2d1defda356
- SHA512 cdbf06718496ded7684702cc6222c58bdadd3af5b31e4c42e5f7f2ee7241f24baf3035da43496b0e851819de192c06b8f145c38e800e75641c9332c1d1f9db87
- SSDEEP 49152:O4+5zNZ7444+YRYf1BvsIcJ1c0tOe7H730INfebZMzGVofKbv6+:x+5zNF477CBEIcJ1hOenErZMzGVofKl
- TLSH T1DDB59D21B9178133ECB702F1897DBB6F945DBE34072441E7A2C82EAE69305D36E3561B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-23_d78fa49e9c04e3f431e7852bd7f10c85_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_d78fa49e9c04e3f431e7852bd7f10c85_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_d78fa49e9c04e3f431e7852bd7f10c85_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4832