133db2376f7609cc65f83d166f5b39d2238c04f0a697dbffad4e0dfea5a3cf9d

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_642adbd0aee2b8786dc7b50e20a4e2b9_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 23.0MB
Sample260826-3amvlavydv
SHA256 133db2376f7609cc65f83d166f5b39d2238c04f0a697dbffad4e0dfea5a3cf9d
MD5 642adbd0aee2b8786dc7b50e20a4e2b9
SHA1 db8c1ec2dc8842db3962f40209141db740b3178a
SHA512 6bea9d76c89e4d4af8738f857024873af5671d5c2ff3d1f253e22c778d746d2f972256761f380f70f1f4cc08f8fc2fa9c521b04b721c2629ec590942250de26d
SSDEEP 393216:JK6HiRE5bxVVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KEd:AUbx3pKOxk6lFiPvQ6yhpKOx5
TLSH
T12C373322B79258A6D8749F7C04196303403F2E47CE98ABEF3BD6376D4A715F189B6843
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1932	VIqkyE0N.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_642adbd0aee2b8786dc7b50e20a4e2b9_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VIqkyE0N.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 1932	5348	2026-08-25_642adbd0aee2b8786dc7b50e20a4e2b9_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 5348 wrote to memory of 4460	5348	2026-08-25_642adbd0aee2b8786dc7b50e20a4e2b9_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-25_642adbd0aee2b8786dc7b50e20a4e2b9_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_642adbd0aee2b8786dc7b50e20a4e2b9_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Users\Admin\AppData\Local\Temp\VIqkyE0N.exe
  "C:\Users\Admin\AppData\Local\Temp\VIqkyE0N.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VIqkyE0N.exe

Path C:\Users\Admin\AppData\Local\Temp\VIqkyE0N.exe
Size 23.0MB
SHA256 fa9f3dff93ba5643f04f0ceb437b4035130cb800de41171ebff37cc278121705
MD5 1aaff45be5958de8ee705300474d9db3
SHA1 d30b6d9f48ddb54d5f6561ce8361a9d8b7996e4f
SHA512 b11698056e587e641df487eaee5eee9e21bd32a3ecbe9d371f54a3e94be1f76147a2a6b9671991578cdf207981f002c4b63892d379075ba68712312e61d500a5
SSDEEP 393216:JK6HiRE5bxBQCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6Qe:AUbx2PvQ6yhpKOxk6lFiPe
TLSH
T14A373322F79258A6D8B49F3C44196303403F2E47CE98AFEF2BD637694A715F08976943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 2a949710522c93a2809c14a8342efe254d0a7867d0131aafac72d89691cdaa4a
MD5 4edb65e7c7b39b988bf8833267a855d3
SHA1 eec71630af512bd3cb4e555388b6709a7ccfedb6
SHA512 3ee4ad13dd5a0f57a3e462eb382f711cebbd3e3c8739646022b29b03d34f983133b7d3663ebc17ff0eb2d27da2e5bff48eda80990a3f36d0bdca23be844d1088
TLSH
T184E020CB04B54E540A05301F03EB366AE454148A2A517AC147B6511B66C354C61F1648
MD5 SHA1 SHA512 TLSH