c9f0b08fa653ab9352623d77a3015b0237544ca0d9c88f9c9358b012a99952a9

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_7afbc1bef944a08465bb53e81f2f2052_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 20.0MB
Sample260907-and6dstsdv
SHA256 c9f0b08fa653ab9352623d77a3015b0237544ca0d9c88f9c9358b012a99952a9
MD5 7afbc1bef944a08465bb53e81f2f2052
SHA1 7d5af678327dd6df5f4738cadfc907f2826a1c7a
SHA512 5a3de07419b9fe253d835b9e5fbcab887b9eab5667abee1e4988246e910964c6e2ecd51bdaab498232ec7c95fd5a530a6c209ca1dd15e78a054aa0f58df2cd10
SSDEEP 393216:2lFyfLPHiRE5bxDrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/l0:AUbxvpKOxk6lFiPvQ6yY
TLSH
T1AE273305B79298A5C8305B7C20286313813E1E434F55AAEF5F967B5D4E78AF1CAB3633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
124	HqbZOo09.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_7afbc1bef944a08465bb53e81f2f2052_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HqbZOo09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 124	4048	2026-09-06_7afbc1bef944a08465bb53e81f2f2052_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 4048 wrote to memory of 2636	4048	2026-09-06_7afbc1bef944a08465bb53e81f2f2052_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-06_7afbc1bef944a08465bb53e81f2f2052_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_7afbc1bef944a08465bb53e81f2f2052_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\HqbZOo09.exe
  "C:\Users\Admin\AppData\Local\Temp\HqbZOo09.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HqbZOo09.exe

Path C:\Users\Admin\AppData\Local\Temp\HqbZOo09.exe
Size 16.0MB
SHA256 38bcc8c447cc63ba273b9e6427bc33debab5090058f5773dea4ccbece14293a8
MD5 30f88fe91366a4939653b52d82a92c2f
SHA1 24dba927782aa0ab9a536cdb2d38cd089c793774
SHA512 7e93bfa845e484e8c877c6272b7f46703fce4d8f867a50fcbf94377abdfe0362661be8b8cbff24433a371f4241aeca6066584c52e45a399b745eb11290f30c18
SSDEEP 393216:2lFyfLPHiRE5bx1SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlF3:AUbx16yhpKOxk6lF3
TLSH
T1D1F63305B792DCA5C8301B7C20686313813E0E034F55AAEF5E967B5D4E78AF1CAB7636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 011e72729b1a63956a95661b964a5fad9d72de9d741a4cd867ed0ae1214de999
MD5 cb0382cbde8a8aed55c2a6e34cdac7df
SHA1 f5b2fe087a6be35cd20491274f9d24260deb3488
SHA512 a11e0a17b05ce7feea619539043f4390206db5ecdfe314954d529b7dc7a086c6497281fbe30d99b776366809f71f0d5ffca9da5bc9c284b286188b4ff1a49385
TLSH
T115E02D4B236D8A88040A306F03F72BCDEA20098B0E02FBC003A0A0A9B1C300C33F4381
MD5 SHA1 SHA512 TLSH