6cea63e510c510bfee8255ee3b09ccc4d4ab7b8215105c42847e63660b57d1e4

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 5.4MB
Sample260718-e7ba3abx21
SHA256 6cea63e510c510bfee8255ee3b09ccc4d4ab7b8215105c42847e63660b57d1e4
MD5 2415bc858bdff0c5837c10d2bea00861
SHA1 8d0b5a18236c96a690cb42f5dc947a7c6895239e
SHA512 7dbb9ff0eaaded86023dd3929ffc188d78c97582f11c10c04d5044dac86be31b54dff67920a43930127e19f4b4621154ed49d7d1c113c0504d67b424c0ba868f
SSDEEP 98304:g7BjLAAZv3zEgtVk2xwgglEHgI/K6Je43CZOvXMGWNfaF:g7dAAugtVvwgglNiKCmOvMGWQF
TLSH
T1D346E04F77D9C1EDFAB666719A34465C1F16BCAA9AF5858F0340B10C18F09C04E3BBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
3388	Install.exe

Loads dropped DLL 3 IoCs

pid	Process
3388	Install.exe
3388	Install.exe
3388	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Install.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3388	3916	2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\payload\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\payload\Install.exe" install ni-package-manager ni-package-manager-upgrader ni-package-manager-released-feed --hide-completion --config="\\?\C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\nipkg.ini" --update-feeds --force-essential --force-locked
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nipkg.ini

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\nipkg.ini
Size 562B
SHA256 e244528747925e484011c6488ccc4582170e2482081f03722e2db52b2ebefa51
MD5 bb2d6f23193e4faa5e512e77e48b528f
SHA1 07a461ad37e351d4b2800b618c89520ad83f537a
SHA512 7ea835e5d3a5eea258093d2fd4ecb311f14c16d742d448ee468b775a5ec9483dedc08f928741154f273ccb01d863859339043c9da7be62704ee874f6c7eb0e23
TLSH
T109F08B42674A3638090C5F96F0B34295A5063879FCC7E9D5B1B83A5D79038DA03132EE
MD5 SHA1 SHA512 TLSH

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\payload\Install.exe
Size 725KB
SHA256 5d4a57422da77d5eabd3e4b2014849c7fe5e5e6fe20b2e9e4c88b2624d9e9487
MD5 590bdd4509187222fb1a2fae758dc23d
SHA1 b00bb249ec8581f6f7ec507879447b33f345c971
SHA512 a47abc551944af0c6c23e0003fc3c236720205f024b20ed962f45b1efac1bd7a36ec2caa6b0db8c02b365d785f2832ea8e10a64af8abb4225e3f6c3ec98c69b8
SSDEEP 6144:0IHepxbaYnwUzKqyRZIM65kl5OW5IXFErMAXlg6QnweRu+ORTpVvWd06v/DNdBBi:iKvZyGC411AKagGRqxy1KXBy5C
TLSH
T1AAF43A0137F8822DF0BB4FB9B47525214A39FD0225B0D55E3649298EDEA7B81C97273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NationalInstruments.PackageManagement.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\payload\NationalInstruments.PackageManagement.Core.dll
Size 198KB
SHA256 a02f7698161a3234a738c615cecf430dae4751baf7771a3006a833b3c29da889
MD5 36d603b1f2711c65de2bb87453bef1cd
SHA1 9398a17e663fa4629830ad4b6387b6bc266f115a
SHA512 a7887a41db2c6fe1cdc94e345f49df34f1fc88090b2275bcf827ed82504d288c7198f3a3540a6df5f223d57b772f05b118d880351b9b71ea621c76289cc33ff8
SSDEEP 3072:+WahoX1LArAC9a/DCfIgs2PshfZn+jtYcnHCR4k8OgC7Wt7NmlbGAI7U0U:+elLHDCggs2+Bn+XCR4YgCQp7AIU
TLSH
T11A14170623F85616EFFBBF3AF87285660B70B94E2921DB8D5944D98D3923B018D12773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nipkg.ini

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\payload\nipkg.ini
Size 412B
SHA256 ac05110e3981595ea3a9ee8629408bd0d02120eee38f269b9d5f72c1a295987c
MD5 525c72fe0678553ee01b9fd94ab8bcdf
SHA1 b8b9363faadbb641172b49210fbc7551f67ee036
SHA512 04ccf7e636f576630b368d3bfc219c8a0e3a64aae17011ae7434bb288de2045e9e5305c48441334e0902e06deff49b095c3269fe6968c93ffbbb5579d0dbffae
TLSH
T1A1E02B431704553858055F97F066434559067C32F4C9A8D9A4F4392CB9534CA03634B7
MD5 SHA1 SHA512 TLSH

Submit Download

nipkgclient.dll

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-feb1-3d7c-04a5-763e\payload\nipkgclient.dll
Size 4.8MB
SHA256 f25bfc4ca4ac9400068c82cd913f334b8fc8f216c68ae07aec95e2a1a0406230
MD5 2dd8e1e9d1049eef575346269514e30a
SHA1 60bb780d9d2c5b226135eed667113d5c9a08ed9a
SHA512 de5b84450fa22c8e038ec30fe35dfa9c6daf65c1e424c63f5ac1ba1d6d0a19050dad32acbad13ab03e39dca5968cd9fb287718213e5df88f8ba33727db2c1f2f
SSDEEP 98304:hw0eM7bHUpIRxGFe2g2X6AqUKkA9sxhxGXQ1I:FTb0pBFlq5SGXQ1I
TLSH
T1E8368C1272D1C129F6FE53B1AD796B29087EFEA00B3585CBA3C4991819309D2AF37717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3388-32-0x0000000005E80000-0x0000000005E90000-memory.dmp

Download

memory/3388-31-0x00000000059E0000-0x0000000005A14000-memory.dmp

Download

memory/3388-36-0x0000000005E80000-0x0000000005E90000-memory.dmp

Download

memory/3388-37-0x00000000062C0000-0x00000000062C8000-memory.dmp

Download

memory/3388-39-0x0000000006980000-0x000000000698E000-memory.dmp

Download

memory/3388-38-0x0000000007000000-0x0000000007038000-memory.dmp

Download

memory/3388-40-0x0000000005E80000-0x0000000005E90000-memory.dmp

Download

memory/3388-27-0x0000000000FB0000-0x0000000001066000-memory.dmp

Download

memory/3388-88-0x0000000005E80000-0x0000000005E90000-memory.dmp

Download

memory/3388-108-0x0000000005E80000-0x0000000005E90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads