f335d42ec66855890f85a7dc990a051e75bd3240047c95907a53bc5b436394cc

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_70c9c830e187bf247b4e4f99f4b31227_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 10.0MB
Sample260827-sl8akaaa95
SHA256 f335d42ec66855890f85a7dc990a051e75bd3240047c95907a53bc5b436394cc
MD5 70c9c830e187bf247b4e4f99f4b31227
SHA1 53e4f55adb64a4790761ecf025dbe015be342ab1
SHA512 259a26dc187f9bd9f6a1e0c9a4f79b3c6932f4a7d4843b5362f311db17d0c886e43f84b010ce4bb6649bc19c634b7f29a0d45d1b366413f3af4c42fe9878083b
SSDEEP 196608:JZ872k1AeAi2KOld5bxRIszNpiRVxK65DzLlQCcHst:JK6HiRE5bxyeIRVlFvlQCc0
TLSH
T143B62322B39258A2D8B4AF7C04196303413F2E87DE98AFDF3BD63B6949715F08977452
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	6UVorPj0.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3196	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_70c9c830e187bf247b4e4f99f4b31227_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6UVorPj0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2008	4192	2026-08-27_70c9c830e187bf247b4e4f99f4b31227_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 4192 wrote to memory of 3196	4192	2026-08-27_70c9c830e187bf247b4e4f99f4b31227_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-27_70c9c830e187bf247b4e4f99f4b31227_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_70c9c830e187bf247b4e4f99f4b31227_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\6UVorPj0.exe
  "C:\Users\Admin\AppData\Local\Temp\6UVorPj0.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6UVorPj0.exe

Path C:\Users\Admin\AppData\Local\Temp\6UVorPj0.exe
Size 14.0MB
SHA256 7f0794637b2b21b0ce37757dd3fb8e101825305a6b2b983efb5199dcb165db02
MD5 6e34a3c25ce95806f01cdbcd4aa6ccd8
SHA1 34c1b23510a2b8bdfa27e9e8b42f7ca962329574
SHA512 3848736a7ee60d3be055e8efa9b9788c877ba73a9c6568fb6c67a71f56ad34583f660eaa58e160f9d7623fc476c3b4a279cc81d15def5d1aeed9ef9b35bf7800
SSDEEP 393216:JK6HiRE5bxiIRVlFvlQCcv6QaAu5SVDMT2:AUbxllFiPvQ6L
TLSH
T10AE62322B79118A2DCB49F7C0019A303403E6E87DE98AFEF3BD637694A715F08977552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 2e60e69134de6e7c755e77d02b2e7a3c8d2679e963001932e48b7b6aacc33ca3
MD5 447a6d70df51a45eecb1cad4663a8cb4
SHA1 d36ceaa14d4f61ac32a9034e42b8876ab2ec5ae4
SHA512 daf3ff5b2c582e0a2e3a6030522cb777e95cc37f20e12113a178b6c00504daf3c5b482fc2a627289926e934de4a9d5a744859023cbb32e5cc46e4daa507e64a3
TLSH
T19BE026C716FC8A10140A705B02FB1599FA6864CF2B91BFE38325521BA5C204C6AF9B80
MD5 SHA1 SHA512 TLSH