0003c0f364b1ef1f55128192d12a103760314a8926ff449f3fb5f590e745b434

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f9b5a7998bc65b7320bc4ba42c16dbc9_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 12.0MB
Sample260821-ckswgseq61
SHA256 0003c0f364b1ef1f55128192d12a103760314a8926ff449f3fb5f590e745b434
MD5 f9b5a7998bc65b7320bc4ba42c16dbc9
SHA1 7a4fa25750ba44b85c01d8fe0f5f10e02155ad63
SHA512 6cd3e3c73f88fc205f1594a8410ecb75ebc7136bde5ad0de610b80858b3204a788d3cf740c5813113b0b8d578ef9d1133d55cf2defa515b40f11e4e100c8a896
SSDEEP 196608:JZ872k1AeAi2KOld5bxRzvOYDMVByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C8WO:JK6HiRE5bxTDMTNSG/lVrl3KExL3JzAt
TLSH
T150C62322B79158A6DC749F7C001D6303403F2E47CE98ABEF3AD637AD4A715F189B6942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3228	Uhx2xUIfX.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uhx2xUIfX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f9b5a7998bc65b7320bc4ba42c16dbc9_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3228	2200	2026-08-20_f9b5a7998bc65b7320bc4ba42c16dbc9_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 2200 wrote to memory of 5680	2200	2026-08-20_f9b5a7998bc65b7320bc4ba42c16dbc9_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f9b5a7998bc65b7320bc4ba42c16dbc9_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f9b5a7998bc65b7320bc4ba42c16dbc9_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\Uhx2xUIfX.exe
  "C:\Users\Admin\AppData\Local\Temp\Uhx2xUIfX.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uhx2xUIfX.exe

Path C:\Users\Admin\AppData\Local\Temp\Uhx2xUIfX.exe
Size 16.0MB
SHA256 c578203f67cbc871edd36ddf77c1297295618ce4c810dbc1c4964a8272e76cbe
MD5 0f2ed3f8e7c0534f979a04ff9f5fde87
SHA1 4f842af9846388809e415c16b63053ffe8b434d5
SHA512 3cea0701f576c463a28cc5a48e7c52cd29ef232f0470cab1e9fa269db4d5358858773606bf9324c8167acb9d89336196d62b2acefb3a84f371793190cd012ab8
SSDEEP 393216:JK6HiRE5bxml3KExL3JzATzC8WfeIRVlFvlQCcv6QaAJ:AUbxmpKOxk6lFiPvJ
TLSH
T1F8F62322B79258A2D874AF7C04196303413F2E47DE98AFEF3BD6376D4A715F08976842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 ee7a0719ac48282cb56ca475c968117bd9909e48322175dc281d5e267f2d6bf7
MD5 5208941cc0dc963cf0e873b47dc1456a
SHA1 1f40b4497ab947b4133efbb6215cfc14bb1fbf3c
SHA512 d51120d16342ceea28069c6501210eaafd5dab9b891cdb070a95b1b163405b0dfa880fde8c01fcfc8be51fa5befeaf35b63ce80d8dfb5ed9d5d52681ee35c412
TLSH
T160E0269B09BEC6C0091A202F4BF76A55F81858561A81BBC08310975938C350CAAF5381
MD5 SHA1 SHA512 TLSH