12e5a7c36dba2f8bd74a2371a39085357ed77e15048cd975da039f992c1f48bd

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_b47ef8b82b9318135684ca770dc72917_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 15.0MB
Sample260904-3rns8aag33
SHA256 12e5a7c36dba2f8bd74a2371a39085357ed77e15048cd975da039f992c1f48bd
MD5 b47ef8b82b9318135684ca770dc72917
SHA1 18efb65ac0f30c4edcaa60b43863a2b1b074df8e
SHA512 c46b1a0a3d5ab4126952b241d9ccb04bb49d78c52b298c6391693e824d669696d9f33cc14169f0b045641e0c23bdf1ea364e1d2899866614b524c4a4df1709c2
SSDEEP 393216:2lFyfLPHiRE5bx66QaAu5SVDMTNSG/lVrl3KExL3JzATzC8Wfe:AUbx6PvQ6yhpKOxkX
TLSH
T191F62309B792DD65C8301B7C2068A313813E1D034F55AAEF5F967B594E78AF1CAB3632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5656	LGB61K9n.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_b47ef8b82b9318135684ca770dc72917_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LGB61K9n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 5656	1492	2026-09-04_b47ef8b82b9318135684ca770dc72917_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91
PID 1492 wrote to memory of 3304	1492	2026-09-04_b47ef8b82b9318135684ca770dc72917_darkgate_elex_luca-stealer_mespinoza_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-04_b47ef8b82b9318135684ca770dc72917_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_b47ef8b82b9318135684ca770dc72917_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\LGB61K9n.exe
  "C:\Users\Admin\AppData\Local\Temp\LGB61K9n.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LGB61K9n.exe

Path C:\Users\Admin\AppData\Local\Temp\LGB61K9n.exe
Size 14.0MB
SHA256 bd150c5f16544f9bc69e8534f905fd08e761dacd61661ff0d0fd58f3a8ff4050
MD5 bfbdbf48e9ef141571df67e40e59adf1
SHA1 4126d5799e802d5b21159a7d31e16968572c5b67
SHA512 d716660f3158537c32f645ee346db221f1f211190fa7e971e116a7fca85b782a6dba5a24541fb7f5cb0b44fd560c2989efe6a845cce8bc3657e2b4c08ac91b0e
SSDEEP 393216:2lFyfLPHiRE5bx/RVlFvlQCcv6QaAu5SVDMTNSG7:AUbxrlFiPvQ6yB
TLSH
T1A3E62306B7A298B5C8301B7C20246313813E1E435F65AEEF5E967B5D4E78AF1C5B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 d1cb0d74a2c1e4de6746768ff7a23b7a41ad178d965e81f20acd3cea93539671
MD5 ea3ddfcbdbf4e3e3594944fe32cb132d
SHA1 d6dbbf6a6d441df00ca6066a7381b69569547a6b
SHA512 8ac06965dc1535dac87ef93e5dd549a371f1f13b84bb39399328faf43a6382e7c4441f182ef9393aa86467ca6405a8fb8b50cc6ba5e9f363281d03b1df457b12
TLSH
T18EE026CF422A8618000AA06B03F71E4ADE14084F2A64FBC14365A62A3DD354CE5F1B85
MD5 SHA1 SHA512 TLSH