6cea63e510c510bfee8255ee3b09ccc4d4ab7b8215105c42847e63660b57d1e4

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 5.4MB
Sample260718-e7ba3abx21
SHA256 6cea63e510c510bfee8255ee3b09ccc4d4ab7b8215105c42847e63660b57d1e4
MD5 2415bc858bdff0c5837c10d2bea00861
SHA1 8d0b5a18236c96a690cb42f5dc947a7c6895239e
SHA512 7dbb9ff0eaaded86023dd3929ffc188d78c97582f11c10c04d5044dac86be31b54dff67920a43930127e19f4b4621154ed49d7d1c113c0504d67b424c0ba868f
SSDEEP 98304:g7BjLAAZv3zEgtVk2xwgglEHgI/K6Je43CZOvXMGWNfaF:g7dAAugtVvwgglNiKCmOvMGWQF
TLSH
T1D346E04F77D9C1EDFAB666719A34465C1F16BCAA9AF5858F0340B10C18F09C04E3BBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2568	Install.exe

Loads dropped DLL 3 IoCs

pid	Process
2568	Install.exe
2568	Install.exe
2568	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2568	4100	2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\payload\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\payload\Install.exe" install ni-package-manager ni-package-manager-upgrader ni-package-manager-released-feed --hide-completion --config="\\?\C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\nipkg.ini" --update-feeds --force-essential --force-locked
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Packages

Path C:\ProgramData\National Instruments\NI Package Manager\eulas\Packages
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

eula-ms-dotnet-4.8_26.3.0.49236-0+f84_windows_x64.nipkg

Path C:\ProgramData\National Instruments\NI Package Manager\eulas\eula-ms-dotnet-4.8_26.3.0.49236-0+f84_windows_x64.nipkg
Size 36KB
SHA256 248c61b05ccf47e04c8e7884d872e9e1338cc0bbccb84d7f9dcca2e2828f6a5c
MD5 9182ee2d24d8b6033a5ef0bae8ff8219
SHA1 656f7a48282460ea583bc9e0d83f7b8efef92a90
SHA512 51d7a7bd17f364cfcfbc6f6127307fe4086ba648dfb874f198fb2e75b3edabfaba8667788f5b05a715e50894aeb03c4eefda1afadff227e2a0254b2183c2ffd8
SSDEEP 768:KiX3MeaQIBd6+VB8QFJnQ7eNq3jN+hTp3HjL581hnA2E/dFXB6S/ap:KiWLpVBTFXqhyT1HjL2I2Kw6ap
TLSH
T138F2E1303A145C9D1DED842311A77609B928E6C92C832ECB753C3B126789B09F367F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eula-ni-standard_26.3.0.49236-0+f84_windows_x64.nipkg

Path C:\ProgramData\National Instruments\NI Package Manager\eulas\eula-ni-standard_26.3.0.49236-0+f84_windows_x64.nipkg
Size 1.3MB
SHA256 bee7a433723a96bf7a930d5f430c8ee309106bdce6415b3339a46204c06561dd
MD5 43136ae9564ff53c9569519ca0ff19cd
SHA1 6e4de3921ba7d00f9d905196198ec42cfd721220
SHA512 923eb723fab85f964c61a3a0b03bad5dd879e59c7980b82e9dab51a7eb34617e4daad0475ca386ddbaa39f54d7046c0df704b9888c722d54c853571ea6f6bcb6
SSDEEP 24576:TiHfM5W6oN9U7ZVlsHMEBkfBlUBuOycKit3twx0iclfwAX2JJaCw3WMkSq:TiHfoW6oNO7ZVlhBlU00fmx0nhX2WCNX
TLSH
T1E95533935A6C3DC9586CD36C3FB1B4BDB240A31205D34D42A07AB71B948AFDED47982B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Packages

Path C:\ProgramData\National Instruments\NI Package Manager\raw\ni-package-manager-packages\Packages
Size 338KB
SHA256 65115bc2264e0cb4cade4c63a19b133f60c9d9553f1cd034b680bf7e808f075c
MD5 eb77c7c66748a4782ad92624071e9c85
SHA1 8b1642597e8c12be6b35617a0e1977facf10f943
SHA512 2795fb1de626d3d9d92172277a2a8e4ed60314bf3f33b3125c8a5c437835263ea47aae32410bdd79049adb35974adb74a6a12a5a4ed54e2d7dcc9de22a3b84fd
SSDEEP 1536:RuZVRILo/rUGSaQmruSDGOTPsNMrhYxbP8qKBCEaMXC4H/OdNSXoBx+PiqXeHEpV:sZVGmNCO2qX9C4zIyk2HllV1
TLSH
T17274B60F53BC62E48D861FCFF637578452B5A265F1D295DEB0FF409C2A0249BC32A8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nipkg.ini

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\nipkg.ini
Size 562B
SHA256 ec3076bade70425da6c12815f87d98a56bff0ea061e636914a600daedfcb4dcc
MD5 2908b615095b1fd667713f2febba5112
SHA1 7bec70cf25b4ea346bc92a91b3fd4345ba9ce2ec
SHA512 a92f093b6bb172b3c6cf08fde36f3c25909ecc7bd6149218a501b46a8067d637c6fd0611a3250e1d5af1fa8b9ae63bf5f720e58e7c5ef630f202f3c9af97be92
TLSH
T181F08B82570A3538490C5F57F0A383A5A5163866FCCBADE5B1A43B5D79538DA03232AE
MD5 SHA1 SHA512 TLSH

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\payload\Install.exe
Size 725KB
SHA256 5d4a57422da77d5eabd3e4b2014849c7fe5e5e6fe20b2e9e4c88b2624d9e9487
MD5 590bdd4509187222fb1a2fae758dc23d
SHA1 b00bb249ec8581f6f7ec507879447b33f345c971
SHA512 a47abc551944af0c6c23e0003fc3c236720205f024b20ed962f45b1efac1bd7a36ec2caa6b0db8c02b365d785f2832ea8e10a64af8abb4225e3f6c3ec98c69b8
SSDEEP 6144:0IHepxbaYnwUzKqyRZIM65kl5OW5IXFErMAXlg6QnweRu+ORTpVvWd06v/DNdBBi:iKvZyGC411AKagGRqxy1KXBy5C
TLSH
T1AAF43A0137F8822DF0BB4FB9B47525214A39FD0225B0D55E3649298EDEA7B81C97273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NationalInstruments.PackageManagement.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\payload\NationalInstruments.PackageManagement.Core.dll
Size 198KB
SHA256 a02f7698161a3234a738c615cecf430dae4751baf7771a3006a833b3c29da889
MD5 36d603b1f2711c65de2bb87453bef1cd
SHA1 9398a17e663fa4629830ad4b6387b6bc266f115a
SHA512 a7887a41db2c6fe1cdc94e345f49df34f1fc88090b2275bcf827ed82504d288c7198f3a3540a6df5f223d57b772f05b118d880351b9b71ea621c76289cc33ff8
SSDEEP 3072:+WahoX1LArAC9a/DCfIgs2PshfZn+jtYcnHCR4k8OgC7Wt7NmlbGAI7U0U:+elLHDCggs2+Bn+XCR4YgCQp7AIU
TLSH
T11A14170623F85616EFFBBF3AF87285660B70B94E2921DB8D5944D98D3923B018D12773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nipkgclient.dll

Path C:\Users\Admin\AppData\Local\Temp\nipkg_preinstall-2412-5420-0dd8-7b6a\payload\nipkgclient.dll
Size 4.8MB
SHA256 f25bfc4ca4ac9400068c82cd913f334b8fc8f216c68ae07aec95e2a1a0406230
MD5 2dd8e1e9d1049eef575346269514e30a
SHA1 60bb780d9d2c5b226135eed667113d5c9a08ed9a
SHA512 de5b84450fa22c8e038ec30fe35dfa9c6daf65c1e424c63f5ac1ba1d6d0a19050dad32acbad13ab03e39dca5968cd9fb287718213e5df88f8ba33727db2c1f2f
SSDEEP 98304:hw0eM7bHUpIRxGFe2g2X6AqUKkA9sxhxGXQ1I:FTb0pBFlq5SGXQ1I
TLSH
T1E8368C1272D1C129F6FE53B1AD796B29087EFEA00B3585CBA3C4991819309D2AF37717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2568-25-0x0000000073040000-0x00000000737FC000-memory.dmp

Download

memory/2568-30-0x0000000007030000-0x000000000706E000-memory.dmp

Download

memory/2568-31-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

Download

memory/2568-29-0x0000000007020000-0x0000000007028000-memory.dmp

Download

memory/2568-28-0x0000000073040000-0x00000000737FC000-memory.dmp

Download

memory/2568-86-0x0000000073040000-0x00000000737FC000-memory.dmp

Download

memory/2568-24-0x0000000005810000-0x0000000005844000-memory.dmp

Download

memory/2568-20-0x0000000000E10000-0x0000000000EC6000-memory.dmp

Download

memory/2568-19-0x0000000073052000-0x0000000073053000-memory.dmp

Download

memory/2568-217-0x000000000D1E0000-0x000000000D2B4000-memory.dmp

Download

memory/2568-238-0x0000000073052000-0x0000000073053000-memory.dmp

Download

memory/2568-239-0x0000000073040000-0x00000000737FC000-memory.dmp

Download

memory/2568-240-0x0000000073040000-0x00000000737FC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads