ce8537bbfcb1e2fe8bf5196e19c4f69e7c46ee42b6421eea6ba32218d6d4c521

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_527e4f1a9db0da6045411024c79083f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 10.0MB
Sample260816-e8k7nazdlc
SHA256 ce8537bbfcb1e2fe8bf5196e19c4f69e7c46ee42b6421eea6ba32218d6d4c521
MD5 527e4f1a9db0da6045411024c79083f4
SHA1 5383a6b940bd794227e08be54802aee36ce0bb26
SHA512 5cd5159cfeaa44cbfa864ed0ff58db56c013c6cb4c863280652106556239880b41cc6eb683df82b0067559468e0f86db45c59baf376ab5b6887682dfadf89e98
SSDEEP 196608:JZ872k1AeAi2KOld5bxRb4C8WfszNpiRVxK65DzL7:JK6HiRE5bxSC8WfeIRVlFv7
TLSH
T15FB62322B79158A2DCB4AF7C04196303413E2E87DE98AFEF3AD6376D4A715F08977442
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2520	rlxxuIvo0Oh.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_527e4f1a9db0da6045411024c79083f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlxxuIvo0Oh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2520	5076	2026-08-16_527e4f1a9db0da6045411024c79083f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 5076 wrote to memory of 624	5076	2026-08-16_527e4f1a9db0da6045411024c79083f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-16_527e4f1a9db0da6045411024c79083f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_527e4f1a9db0da6045411024c79083f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\rlxxuIvo0Oh.exe
  "C:\Users\Admin\AppData\Local\Temp\rlxxuIvo0Oh.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 c604722d4a5505b298d05508deecf914c37c8da9de9a7888f6c9276724202d4d
MD5 51e3dd433324403ed7774517206b190c
SHA1 d47d0b8eb56bb1b868182e4c7319555ec4b6f173
SHA512 486c97dceacf5fc9a96c074945105f3d1950ff43d3e4818f67a602fc4944681af4ee34610bdb1fba7abfdd4e4a451a84a5eff3f66d6d2cba3ebcadadd018e6fa
TLSH
T161E026474A6889000D16602F02FF3A89FA191C8B1A70BFC143258A7EA9C304C6AF5695
MD5 SHA1 SHA512 TLSH

Submit Download

rlxxuIvo0Oh.exe

Path C:\Users\Admin\AppData\Local\Temp\rlxxuIvo0Oh.exe
Size 20.0MB
SHA256 7191668de56121c5f30102fe45f482df35b2aaa72cef932e974df3eb82b8165e
MD5 56158d4935c70039e9959c050c55e5d4
SHA1 22c61f1bea0e3ec7c399ee8c735e235107164ba0
SHA512 1771d661449e0dae81d7cbf52d77ba85d66abd1651e68290bbda2bc8ca2ca2b2fb9f6066a64d2d3bc4806fd2446dad905a32e9e4ca8e4e9ac86afada944c6445
SSDEEP 393216:JK6HiRE5bxc3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVY:AUbxuKOxk6lFiPvQ6y+
TLSH
T160273322B79258A6DC749F3C04196303403F2E47DE98AFEF3BD637694A715F089B6942
MD5 SHA1 SHA512 SSDEEP TLSH