463905a059de279cbe39f013dfbd970efe24a9dcaad05cea71497b04df78cdcd

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_95d54a47f8232c2b69036306ba98ff4a_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 17.0MB
Sample260826-vb6ebsgm4v
SHA256 463905a059de279cbe39f013dfbd970efe24a9dcaad05cea71497b04df78cdcd
MD5 95d54a47f8232c2b69036306ba98ff4a
SHA1 d4c51802805941b9bd781a5abd67c8bdc4688a66
SHA512 e49819508073270bef4788bbdc2944a3b37db94cfb0d4e5305f24e1d953cbe15f9ca7b965a471033ce1058e7589430acdfd64e869c133de274e256cbd2438655
SSDEEP 393216:JK6HiRE5bxxAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFf:AUbxCQ6yhpKOxk6lFf
TLSH
T1AB073322B79158A2DC749F7C04596303403F2E47CE98ABEF3BD637AD4A715F089B6942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	4gi1AlZlSQ4pr.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_95d54a47f8232c2b69036306ba98ff4a_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4gi1AlZlSQ4pr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 2872	6044	2026-08-25_95d54a47f8232c2b69036306ba98ff4a_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 6044 wrote to memory of 4316	6044	2026-08-25_95d54a47f8232c2b69036306ba98ff4a_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-25_95d54a47f8232c2b69036306ba98ff4a_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_95d54a47f8232c2b69036306ba98ff4a_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\Temp\4gi1AlZlSQ4pr.exe
  "C:\Users\Admin\AppData\Local\Temp\4gi1AlZlSQ4pr.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4gi1AlZlSQ4pr.exe

Path C:\Users\Admin\AppData\Local\Temp\4gi1AlZlSQ4pr.exe
Size 12.0MB
SHA256 6e5d8372465a1814bd47e51d6b0119f8738907833bf7bfe570128d8f6220dcb1
MD5 36a8831b66bdc96ded7f169f26e5aae2
SHA1 2c81b4bea6362ff6aaa50194a7ef94ab86e8ba19
SHA512 74dcf77640f04dcddf8ae868320c8083b84e80e01151930da0e964b2fa07af1ba85a5b4e190c7e185f77310011845d5186d35d1dcfec2dbeaf71c5d01dc3de16
SSDEEP 196608:JZ872k1AeAi2KOld5bxRs3JzATC4C8WfszNpiRVxK65DzLlQCcHw:JK6HiRE5bx23JzATzC8WfeIRVlFvlQC1
TLSH
T1ADC62312B79258A2DCB4AF7C04196303413E2E87DE98AFEF3AD63B6D49715F08977442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 ff09ab54c176d6148da4b6a004038ae9d1f45b635f6c8d78ecd6f8355278b82b
MD5 a455226444cb31f77e5fdd09f94bd236
SHA1 40131dc8205fb4d26ed9131492496f5696a5cef4
SHA512 abc01f0a24cd71b461def1a3e102c24a83d94d78e035fec757f0fd49f34c8b6440ca8ea98790bca8b43cfbc2f2d27450fa977649ec9b7dac1b0f6729ef0bdce2
TLSH
T1B2E0260B45F98E060506302B07FB2A87E898A8A71A06FAC1635051293FC700CA2F2295
MD5 SHA1 SHA512 TLSH