603e925ad9ecb43c75ee6c311c33a974304f71c59c5fefff3931f4b9a9cd046a

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_a527186684b19d394d6936b35b7a1f34_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 17.0MB
Sample260826-r2spdaer2w
SHA256 603e925ad9ecb43c75ee6c311c33a974304f71c59c5fefff3931f4b9a9cd046a
MD5 a527186684b19d394d6936b35b7a1f34
SHA1 022b2ca1942a83a01373a10c55f8cb91f1f20049
SHA512 f264d824ca83cca6bc75e4f8ed9ba510c6dc7986ad87ca28b761fe05e0222e3a3f7dbc815995b850f6b768038af2b007b0b2c1c255217248a96ed9f373f92557
SSDEEP 393216:JK6HiRE5bxoL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMz:AUbxExk6lFiPvQ6W
TLSH
T1EB073322F79158A6DCB49F3C04196303413E2E87CE98AFEF2AD63B694A715F08977543
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1888	Qh6O4HD0dm.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qh6O4HD0dm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_a527186684b19d394d6936b35b7a1f34_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1888	4748	2026-08-25_a527186684b19d394d6936b35b7a1f34_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90
PID 4748 wrote to memory of 1928	4748	2026-08-25_a527186684b19d394d6936b35b7a1f34_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-25_a527186684b19d394d6936b35b7a1f34_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_a527186684b19d394d6936b35b7a1f34_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\Qh6O4HD0dm.exe
  "C:\Users\Admin\AppData\Local\Temp\Qh6O4HD0dm.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Qh6O4HD0dm.exe

Path C:\Users\Admin\AppData\Local\Temp\Qh6O4HD0dm.exe
Size 14.0MB
SHA256 1bad2e6f0b7e07f51e513061e913d986f8afc9184b95484838e78482aebff836
MD5 05b88d3801063bd91b5c18528d37b3cb
SHA1 40a292bccf5c17e13de294ef0b70f4e70634e693
SHA512 099da00c78dd2cc5096a932cd3e62667aa1b9ee6bfe876eac3e42eee7152570553d076d13e3db9d0b7b790d8db1eebf8214f9dee59f6a3c73949e2ec2f28bae9
SSDEEP 393216:JK6HiRE5bxHDMTNSG/lVrl3KExL3JzATzC8WfeIRVj:AUbxHyhpKOxk6j
TLSH
T1CBE62322B79158A6DC749F7C041D6303403F2E47CE98ABEF3BD637A94A715F189B6842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 c7c3739cdbf9c176a122f4720b920de99585d3cb3d8ba4429e9575340c718f2b
MD5 f588fee689dc5d8eb3165d3b4b64f66b
SHA1 a76890cd7bebf1913b22b77110ddd0ae305df009
SHA512 504585042a42b8018ec6ba774d032df1d9f4dc5c97cf39cf93493916329fef3fc5000fb148e008bfb8d5dc87ae2178b115138005317616c219d9b6c54033225a
TLSH
T1C5E0209700A6CED00586B01F12F76547F51454D71941FAC14311451B76C708CA6F525C
MD5 SHA1 SHA512 TLSH