b09c0dd90618bf4035d290a76ecf4fb93ccbd8239f3ac4a6bfcd7262f40fba42

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 11.0MB
Sample260821-dds4ca1fnd
SHA256 b09c0dd90618bf4035d290a76ecf4fb93ccbd8239f3ac4a6bfcd7262f40fba42
MD5 70fd9cdd21d779c2f8b907d05f339f2e
SHA1 29e2bd268d9fd8e1e7bc656500b2d35e1b6da1f1
SHA512 1ca3fa57971d86c1e68caebe5fa499202276d54433ec2e4435df9286bc5e6ab13d50fce6f47d0935b652596d513ba4897a43d368e57d7fdadbb00ca879625917
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxR8WfszNpiRVxK65DzLlQCcHsQ:2lFyfLPHiRE5bxR8WfeIRVlFvlQCcl
TLSH
T135C6230AB79298A4C8312B7C20246317813E1E434F65AEEF5E967B5D4E78AF0C5B3573
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4836	2VpdNJ7f8FlMU.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1480	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2VpdNJ7f8FlMU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4836	4196	2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe	85
PID 4196 wrote to memory of 1480	4196	2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\2VpdNJ7f8FlMU.exe
  "C:\Users\Admin\AppData\Local\Temp\2VpdNJ7f8FlMU.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2VpdNJ7f8FlMU.exe

Path C:\Users\Admin\AppData\Local\Temp\2VpdNJ7f8FlMU.exe
Size 18.0MB
SHA256 5842a05ba28e8bece816fe2644c23cef53a84157656524e98495e0250ad9fff6
MD5 d07a027be4fff1fc352e5932a4bdba41
SHA1 4f8595cea91d83e23a4324fcb4a0bbee1ea98761
SHA512 a41499cfa8699a1f56a2b6d919114a9a6265e3c449c452c0ee795d898506e394f4c791e46a67742f05970cc8430ed2b6d264e4267dbc29d5ce89a2a0758f98e8
SSDEEP 393216:2lFyfLPHiRE5bxhvlQCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRc:AUbxhiPvQ6yhpKOxk1
TLSH
T1B817330AB792D965C8301B7C20286313813E1D034F65AAEF5F967B594E78AF1C9B3637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 5d624d217f005e9449cb9da8e8d3f25ee31e884b76a6cf0ff22c8406039b9ff4
MD5 f6d1032608de9a5e2ec9a1f7a8d34506
SHA1 fe14db88608ddf71b1bfd3020550736fd402d562
SHA512 b49e0a2b0ca454656b632dc8b63e9fe092ed0054e72d48eb029bea94aa27ec2a65c0ad17a1287215f34efacaf2297afd83a44040f6a81918098e4340266653a4
TLSH
T1DCE0260720B885C40B0A74AF42FF3945F918586FAA61BBC08324451A39D325CA7F6AD5
MD5 SHA1 SHA512 TLSH