b63d3ca6b27dcfe378cedd1a2b91e92d301ba09a52065aba4c79b3a28f0b4718

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil.exe
Size 2.5MB
Sample260926-2b4dastt6l
SHA256 b63d3ca6b27dcfe378cedd1a2b91e92d301ba09a52065aba4c79b3a28f0b4718
MD5 58ed300226a21650fa64aebbfb432e36
SHA1 4177ccfe53d709e90da6d722f9659f574500a638
SHA512 0ffd6eb41ccd9753883928b57ef4372a7444e487ba1d7cd4adb682e37f7ed23a97f168685f5db87e2413d247c996acc7b69c74f42bd7c329166dbf7dc1e1800c
SSDEEP 49152:xfTGDfBoRdiyBRusf8yLZY/3dEJpu9p1RdrqDM7ZsaoSqaA9pvLSkdYPuKTHFpM6:xfTGDfBoqspep17eDMiaA9hfGFpMaQlg
TLSH
T174C5BF23BA828172E5A30231957BA77F4939BA30233985D7D3D41D2D4D706D36B3A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_20260926.log

Path C:\Users\Admin\AppData\Roaming\running_bull_guniuniu\logs\misc\update_20260926.log
Size 1KB
SHA256 a10331581f26215612559af677a9f6b33945613b787e0cc1df77d1242ea1f7eb
MD5 6f40b7b210c3b4eba3c1ba57a4a0dfcf
SHA1 f6b44bb80a6136c429ea221528ed3cac405ee319
SHA512 4b76622dc3808ebf9e511a31275745224ceb6951fa07bb389f488470598c4ecb067448d501648faff26302d7858a6b99c535611e26cb0e6bfd38b7a824bca9cb
TLSH
T1AE41240935BA723CAD1E5833621F5A0F44F276E4D159B951BB102AC92C5882CFBAFF35
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4688-0-0x0000000000800000-0x0000000000A88000-memory.dmp

Download