8a472bdd5f935df7624409651464ffb6a0ff6e2bde7198cf91afbe552d14e861

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_a50243db8ec0a1ebbb44f25d068df8f0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 15.0MB
Sample260813-eke1qsaq5x
SHA256 8a472bdd5f935df7624409651464ffb6a0ff6e2bde7198cf91afbe552d14e861
MD5 a50243db8ec0a1ebbb44f25d068df8f0
SHA1 713d95c5a1ea0ee7548ccce4e1896a6f993f904c
SHA512 2d6bf590a06952d405d9108a58213facc76d562b0d6d8cf74a30fbe9a3e197de238065a30dc27f55db9034cd815c1e7fee1b11053a1a1a2ef0ac8844280f082d
SSDEEP 393216:2lFyfLPHiRE5bxeu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRV3:AUbxeQ6yhpKOxk63
TLSH
T1FBF62305B792DDA5C8301B7C20686313813E0E034F55AAEF6E967B5D4E78AF1C9B7632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2392	xZAsRCjTD.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a50243db8ec0a1ebbb44f25d068df8f0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xZAsRCjTD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2392	4684	2026-08-13_a50243db8ec0a1ebbb44f25d068df8f0_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 4684 wrote to memory of 4828	4684	2026-08-13_a50243db8ec0a1ebbb44f25d068df8f0_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a50243db8ec0a1ebbb44f25d068df8f0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a50243db8ec0a1ebbb44f25d068df8f0_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\xZAsRCjTD.exe
  "C:\Users\Admin\AppData\Local\Temp\xZAsRCjTD.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 827ecb71d910de9bd76fa2d9c561be1720eb128748a4644c8837c979c0bf4a53
MD5 ab7fa2f201e6ca9ed03cbb370f776723
SHA1 e5b915fa002e7ce80f4f5569594ceb6da2d76851
SHA512 0f874a55f3bfbd7176dda9cf1bdd683cae318a0fd548e3b396ef42b973efd346c22ff8e91d3debc1e2aac3fcbb87e23204be96d1331c29e31d95be1d3f5d05f5
TLSH
T12BE0264F0AB48BC02806A02F02EF569AE87454DB3A42BAC49354521A24C285C69F9A91
MD5 SHA1 SHA512 TLSH

Submit Download

xZAsRCjTD.exe

Path C:\Users\Admin\AppData\Local\Temp\xZAsRCjTD.exe
Size 16.0MB
SHA256 e783f4fa826ac8c6dcfe6a542fa47bbba98309679e7f9cf4d63d9b87e2d745eb
MD5 f1484738e93dc51856b38fd533e5c041
SHA1 0855b31898446e6b0a99136d2e0aef0b0a931b2e
SHA512 7c95a5707a77c5cc0f279cb47e7974ebd8ad116ea2dab4aff3e93cda0abf482524f88779e78859a4351184119830899476c1ad1f2d3cc0907625330c7e300d14
SSDEEP 393216:2lFyfLPHiRE5bxEFvlQCcv6QaAu5SVDMTNSG/lVrl3KExL3Jb:AUbxEFiPvQ6yhpKO5
TLSH
T1B4F63305B7A298A5C8305B7C20646313813E1D038F65AAEF5F967B5D4E78AF1C6B3633
MD5 SHA1 SHA512 SSDEEP TLSH