945921386ddb960443a2b6352e81717c9f485f69d13e42a481111b7d340fd114

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_b99e8bbc15e148b81bf8c40200384cb0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 19.0MB
Sample260820-3gfd4a1tcs
SHA256 945921386ddb960443a2b6352e81717c9f485f69d13e42a481111b7d340fd114
MD5 b99e8bbc15e148b81bf8c40200384cb0
SHA1 aeec5132664afe9d9c847f3a589abe35bd78f3dc
SHA512 d626af2b8d85a94d0c0f77286bfe6b6329695615ddb84ca7ad72e007d1ecc0d5735f5d94e5866ed3bd191c71649719db9e8cc42bec6b24dc0a988848a2b98bec
SSDEEP 393216:JK6HiRE5bx1NSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5Se:AUbxThpKOxk6lFiPvQx
TLSH
T1CF173322B79258A2D8749F7C04196303403F2E47DE98AFEF3BD6376D4AB15F08976852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5792	vsaP5GgqVH.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com
1	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6296	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_b99e8bbc15e148b81bf8c40200384cb0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsaP5GgqVH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5792	4324	2026-08-20_b99e8bbc15e148b81bf8c40200384cb0_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90
PID 4324 wrote to memory of 6296	4324	2026-08-20_b99e8bbc15e148b81bf8c40200384cb0_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-20_b99e8bbc15e148b81bf8c40200384cb0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_b99e8bbc15e148b81bf8c40200384cb0_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\vsaP5GgqVH.exe
  "C:\Users\Admin\AppData\Local\Temp\vsaP5GgqVH.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 22e4ceb78a5660b4da95d93f266a5cb94739ac2ab76d9cb60bcfa3122b74aaa0
MD5 61b70c62975df6a66ae65fa65bd33428
SHA1 30d337f1022ff696195879cccd814e9309321e06
SHA512 327e944e47521082dd51ce4155b414a1f04a34470b917160deff5515efed8433ebcff4182a631bc8324135fd615ea1e199ad9aec41dbbef74ade18846608c4e9
TLSH
T179E0268706FB8E001D4B21AF02EB158DE82428961A90BFC59360D15DBADE60C62F2394
MD5 SHA1 SHA512 TLSH

Submit Download

vsaP5GgqVH.exe

Path C:\Users\Admin\AppData\Local\Temp\vsaP5GgqVH.exe
Size 16.0MB
SHA256 6d5605eaa9330a4111d64d69543ec8a43246b343bbcf67d9a0ef8231d9e5f69c
MD5 ac4c42216dff90b7fe9d0eed86955f2e
SHA1 55c568f2ae7dcacc7d325a1e954e860fa6243047
SHA512 a2673d7a315b8481f4a4ec1e6e3c9164676016e183227788b819527057e9e2b7ab512a5219912206cab06c8a1b5083f16fe62c29a570a570abcd55011dea7335
SSDEEP 393216:JK6HiRE5bxoDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcs:AUbxoyhpKOxk6lFF
TLSH
T15CF62322B79258A6DC749F7C04196303403F2E47DE98ABEF3BD637AD49715F089B6842
MD5 SHA1 SHA512 SSDEEP TLSH