853a7b0bfb4ff00a0141c0211f567da05f0a060a9dbd525654864dfba2a9c1f6

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_5afe45884c893ca31acb7e49048a2934_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 14.0MB
Sample260824-m7treastgs
SHA256 853a7b0bfb4ff00a0141c0211f567da05f0a060a9dbd525654864dfba2a9c1f6
MD5 5afe45884c893ca31acb7e49048a2934
SHA1 a110ca3e28a08c9b410e2e864001b7b743a3dea6
SHA512 b4b9579c540efd73f1e16a5e8adb34dc43548f95df5e96d753018dd43ec8ed8f2c40dd98442da40931d9054f6937349fc36989956a8e5159a0526111299549fd
SSDEEP 393216:2lFyfLPHiRE5bxsrl3KExL3JzATzC8WfeIRVlFvlQCcC:AUbxApKOxk6lFP
TLSH
T1ABE6230AB7929C61C8302B7C20286317813E1D434F65AAEF5E927B5D4E78AF1C9B3577
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5692	ghcuTWBcy7.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4592	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ghcuTWBcy7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_5afe45884c893ca31acb7e49048a2934_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 5692	3852	2026-08-23_5afe45884c893ca31acb7e49048a2934_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88
PID 3852 wrote to memory of 4592	3852	2026-08-23_5afe45884c893ca31acb7e49048a2934_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_5afe45884c893ca31acb7e49048a2934_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_5afe45884c893ca31acb7e49048a2934_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\ghcuTWBcy7.exe
  "C:\Users\Admin\AppData\Local\Temp\ghcuTWBcy7.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 8505d4ef2a2d8b7a539554fdf5b249987f50de3d990c207ec2f9d3298fcb4451
MD5 ba2707f0ccb5f3e091b4bbcf1cbe88a3
SHA1 493b7dcd9a82d85d1b749ea15602047b5c13f9fb
SHA512 5e947036198adaaab51765f41d318af15ff9ada19e3f69bf42e86d29014281f758119017b4c9c8c0ef52da9840d3d1c9359a3fa8b6a43b0c6061ee75344fe85a
TLSH
T138E0260701B585A80916702F27FF1646F868248B1E55BFD853A6593E3ACB0CCA7F2784
MD5 SHA1 SHA512 TLSH

Submit Download

ghcuTWBcy7.exe

Path C:\Users\Admin\AppData\Local\Temp\ghcuTWBcy7.exe
Size 10.0MB
SHA256 a37064e36418ea5f0db4c6c6659dd5a707f1135ba569d9891a44daf97e834780
MD5 289fd91b86df55c2f5e721929dfc0266
SHA1 d0164ffaf1843349282d5800b4d3de6353843ef9
SHA512 5693bc6ed7dc7bfefe3f54d2030ee4af3819e1c0c469ce7e83d5a45ffec3e21df1e8cb2c1bc4fcf048883c0874ff0388a0bf1b9d0734c8d31805457bc0af355e
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxpJzATC4C8WfszNpiRVxK65DzY:2lFyfLPHiRE5bxpJzATzC8WfeIRVlFM
TLSH
T10DB62306B792D965C8302B7C20686313823E1E434F65ABEF5E927B5D4E786F1C9B3532
MD5 SHA1 SHA512 SSDEEP TLSH