d732fbf1a90715d7bf016a06e41961c583c68d02c756df7baa47ba04362f5980

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8ccccc231bf458d793bfd2d1f860bb33_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 704KB
Sample261012-txlrdagx4m
SHA256 d732fbf1a90715d7bf016a06e41961c583c68d02c756df7baa47ba04362f5980
MD5 8ccccc231bf458d793bfd2d1f860bb33
SHA1 998d8714c137f446575a1545803ad0573f9209b1
SHA512 9fce76bd1ef7059e1aa2056536bb75db02416eb6a8e4c06c958aafb3f67e0155ef6110abe8ab87e8748180f9010a741ca03c946920358697696c3708d9b6ef6d
SSDEEP 12288:yTznDosTkZfQ+UJqmmIMcKzlasRFOx7BuCM5nAgz8peCrm0vk4yhcTdD:sJTkZfQ+UJqmmIMJUs1rz8p9XkK
TLSH
T160E49E1179C1803AE9B311724ABEA67A556DB8310B2459DB93CC0F7E5FB48E27E3131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_8ccccc231bf458d793bfd2d1f860bb33_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	2026-10-11_8ccccc231bf458d793bfd2d1f860bb33_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2600	2026-10-11_8ccccc231bf458d793bfd2d1f860bb33_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8ccccc231bf458d793bfd2d1f860bb33_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8ccccc231bf458d793bfd2d1f860bb33_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 348B
SHA256 2ded6d976c3dd8fd81e8613f244c034a160dff5c371e92c1d32ae1bb60a04193
MD5 c8131906ce81f4a1190bbf9eb3a0092c
SHA1 cef150388c04004c5f58f10d4fd9da5ef550b7b9
SHA512 f69df46bd17bb82da5e6bf68d12436478ccfbcb9642e9256e7d8788c3559c36baa0b4a63ad54794a3d3ecaae1f198d2103728e6236f4087d197b5d51aae6ce8a
TLSH
T1A3E028C00D002551F075E55CE8571BC0F0AAB00E44C15074FF6447DE197C52C13D8503
MD5 SHA1 SHA512 TLSH

Submit Download