0dd7c23a72013a14c29f3ab72942b73c02c92661379ab0e1efdf639ae9e2ba03

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e76981aa8c983dfdad3256c4d5f1a98f_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 13.0MB
Sample260826-e4xpwsyxdy
SHA256 0dd7c23a72013a14c29f3ab72942b73c02c92661379ab0e1efdf639ae9e2ba03
MD5 e76981aa8c983dfdad3256c4d5f1a98f
SHA1 51d358e19afc7810418af2b2179af65c584f48bb
SHA512 7ab0d771931a1cfe9c34cc4dd683512d5b0fe6598038e5b3460ffc7ddad60eb3746a37a55b9e2d842053562142e882520fc894570cac1199fe608d01a5c2551b
SSDEEP 196608:JZ872k1AeAi2KOld5bxR9szNpiRVxK65DzLlQCcHsJcQvQaT0u5SHg:JK6HiRE5bxjeIRVlFvlQCcv6QaAu5SA
TLSH
T1E8D62312B39258A2D8B49F7C0419A303413F2E87DE98AFEF3BD637694A715F08977452
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4208	WyBzJIATcUYA.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e76981aa8c983dfdad3256c4d5f1a98f_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WyBzJIATcUYA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4208	1196	2026-08-25_e76981aa8c983dfdad3256c4d5f1a98f_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 1196 wrote to memory of 4876	1196	2026-08-25_e76981aa8c983dfdad3256c4d5f1a98f_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e76981aa8c983dfdad3256c4d5f1a98f_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e76981aa8c983dfdad3256c4d5f1a98f_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\WyBzJIATcUYA.exe
  "C:\Users\Admin\AppData\Local\Temp\WyBzJIATcUYA.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WyBzJIATcUYA.exe

Path C:\Users\Admin\AppData\Local\Temp\WyBzJIATcUYA.exe
Size 18.0MB
SHA256 0507abef5dd6be77131299b60cde902ad91f60c8400073eda1344011cdd12d57
MD5 43ecf8aa7b31205a9f18030098f94dd4
SHA1 5f438b48535475d652f4cc7a097e07ba5ed1ceb0
SHA512 ccdfb56a6c1e7d8819f32f49911e8336ef78934c6b8951125e0aa885384e24eb02f036a2c7d4e4b30375040032c4c75072f076dc9861e5511dd50a5008c9edd0
SSDEEP 393216:JK6HiRE5bxDQaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFve:AUbx8vQ6yhpKOxk6lFG
TLSH
T18A173322B79158A6DC749F7C04196303403F2E47DE98ABEF3BD637AD4A715F089B6842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 dbc957dd456029d70862ef90b122c02de123905746a7326ba2d9d62ffaa1edfe
MD5 03559f3da0721734b11233f7e34a59e2
SHA1 9c91fb88c3df083966e4ba951fe31dd6dc47cd4d
SHA512 6b6eebd539334f57c7330b89b29c797074e22b5f7cd8a3176d12080f2e3dc9505cacf188ba65ffcfc72b89d57f503dcdeab01a8359e4d983bb69d9a885d39b11
TLSH
T1D3E0261784F58B40084B305F07FB6A5AEA9668C73A60FBC28364A61A26D304CB6F6385
MD5 SHA1 SHA512 TLSH