2907ddf83f47337f5e4af17969ce885ee5b391bb86b4ac6c7645f9b708b25ba4

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_153ab8a05f454c39f9838dca27cd9da4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 19.0MB
Sample260908-x3nppsxdph
SHA256 2907ddf83f47337f5e4af17969ce885ee5b391bb86b4ac6c7645f9b708b25ba4
MD5 153ab8a05f454c39f9838dca27cd9da4
SHA1 46525e01635ce207d77b8aef197cb42e4a69bb0f
SHA512 0322b44515366a5f9bd3739e1c0aa9e278a12e2439d829d646e35c64b7ccc5e736eb1af7baf5fee2c82e94bcf2bef0bdc3598d6bd653259c3a8ff289f591d492
SSDEEP 393216:JK6HiRE5bxVNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5So:AUbxzhpKOxk6lFiPvQ1
TLSH
T12F173322B79258A2D8749F7C04196303403F2E47DE98AFEF3BD637694AB15F08977942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5948	pmfOoaGC.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4544	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_153ab8a05f454c39f9838dca27cd9da4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmfOoaGC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 5948	1464	2026-09-08_153ab8a05f454c39f9838dca27cd9da4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88
PID 1464 wrote to memory of 4544	1464	2026-09-08_153ab8a05f454c39f9838dca27cd9da4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-08_153ab8a05f454c39f9838dca27cd9da4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_153ab8a05f454c39f9838dca27cd9da4_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\pmfOoaGC.exe
  "C:\Users\Admin\AppData\Local\Temp\pmfOoaGC.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 69bf88081e95377e642175b10be785b2ecc820ebc14c916703f139691c9c1c77
MD5 9741fee81cc9859d1c450703541105a6
SHA1 1e279bd146aa0f2d8aaf79c9ee8e20d38148a590
SHA512 b8a398d9f7a7a3b9f513e30f6ac04963f13e65d2712d6b7d6d842f0811347fb97bef882b38989c9e99ddf9a87ff46683456982bc85ab7fd5e7ebf030c6941f78
TLSH
T140E07D4B0424CB42040A701B03F72FC9D9AC5D5F1B11FBC04320D67E35C219C69F6794
MD5 SHA1 SHA512 TLSH

Submit Download

pmfOoaGC.exe

Path C:\Users\Admin\AppData\Local\Temp\pmfOoaGC.exe
Size 12.0MB
SHA256 3aa3c15278e40779e3c06e9d57a3dd6e79077c2f2ed0f1b8697cedc846157c49
MD5 4e93d989777821b90db54212d30dd7d2
SHA1 4c296060f22dbcc00568899c61e3afe4c930bdef
SHA512 7b71e69c8320fc40a7e6c380bab65ce7d08fbb31406e70ee878a6d9e1ff4c4dddb5402d9815e489af5322031ae196828ad330cf05a0a216d4b03f7d9ddbbdc37
SSDEEP 196608:JZ872k1AeAi2KOld5bxRTDMVByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C8WfszNpl:JK6HiRE5bx1DMTNSG/lVrl3KExL3JzAh
TLSH
T14EC62322B79258A6DC749F7C041D6303403F2E47CE99ABEF3BD637694A715F089B6842
MD5 SHA1 SHA512 SSDEEP TLSH