b09c0dd90618bf4035d290a76ecf4fb93ccbd8239f3ac4a6bfcd7262f40fba42

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 11.0MB
Sample260821-dds4ca1fnd
SHA256 b09c0dd90618bf4035d290a76ecf4fb93ccbd8239f3ac4a6bfcd7262f40fba42
MD5 70fd9cdd21d779c2f8b907d05f339f2e
SHA1 29e2bd268d9fd8e1e7bc656500b2d35e1b6da1f1
SHA512 1ca3fa57971d86c1e68caebe5fa499202276d54433ec2e4435df9286bc5e6ab13d50fce6f47d0935b652596d513ba4897a43d368e57d7fdadbb00ca879625917
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxR8WfszNpiRVxK65DzLlQCcHsQ:2lFyfLPHiRE5bxR8WfeIRVlFvlQCcl
TLSH
T135C6230AB79298A4C8312B7C20246317813E1E434F65AEEF5E967B5D4E78AF0C5B3573
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
236	fXTCVw5b8LKov.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fXTCVw5b8LKov.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 236	3320	2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 3320 wrote to memory of 1696	3320	2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_70fd9cdd21d779c2f8b907d05f339f2e_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\fXTCVw5b8LKov.exe
  "C:\Users\Admin\AppData\Local\Temp\fXTCVw5b8LKov.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 5d624d217f005e9449cb9da8e8d3f25ee31e884b76a6cf0ff22c8406039b9ff4
MD5 f6d1032608de9a5e2ec9a1f7a8d34506
SHA1 fe14db88608ddf71b1bfd3020550736fd402d562
SHA512 b49e0a2b0ca454656b632dc8b63e9fe092ed0054e72d48eb029bea94aa27ec2a65c0ad17a1287215f34efacaf2297afd83a44040f6a81918098e4340266653a4
TLSH
T1DCE0260720B885C40B0A74AF42FF3945F918586FAA61BBC08324451A39D325CA7F6AD5
MD5 SHA1 SHA512 TLSH

Submit Download

fXTCVw5b8LKov.exe

Path C:\Users\Admin\AppData\Local\Temp\fXTCVw5b8LKov.exe
Size 11.0MB
SHA256 e26a5da1de763eb3a847664c6b056a1f389fc0bfced7903ba6b6a2bab9b69a02
MD5 70a996e7af3c3dc9496e1f614bab5318
SHA1 f47d73af40425dc9ff83df1474d0c8f8ec015444
SHA512 3ee4cc9f25846f4db866514385aebffc8f151f06f8b0ca8a25cd66faf8f044f8ae523c3bac6d09976a64f8c1b6e05305d430c93127f5f9b725ec32bbc10637c9
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxhATC4C8WfszNpiRVxK65DzLlQCck:2lFyfLPHiRE5bxhATzC8WfeIRVlFvlQG
TLSH
T1DCC6230AB7929965C8302B7C20286317823E1D434F65ABEF5E927B5D4E78AF0C5B3573
MD5 SHA1 SHA512 SSDEEP TLSH