01fdb4336ddf0f0fc5fe44f133a49d3fef82e591de9ff3f0b2bbe2df8a9a8973

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_acf04cc08aedf56675882323e4d3f33c_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 20.0MB
Sample260910-d2x27sx1ct
SHA256 01fdb4336ddf0f0fc5fe44f133a49d3fef82e591de9ff3f0b2bbe2df8a9a8973
MD5 acf04cc08aedf56675882323e4d3f33c
SHA1 ff3ec5a97bb142f69b4fcceda06142080093f402
SHA512 7329f42d5bb5aa2060eabce9aece76ca4014dadddb9a0297e57068e5c5a782cbd2ed7ec63a2e150b01a3c6762352d565838c5e8773495e13a9b59e4242d36e2b
SSDEEP 393216:2lFyfLPHiRE5bxDeIRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8Wm:AUbxdlFiPvQ6yhpKOxkD
TLSH
T1F4273305B79298A5C8305B7C20286313813E1E434F55AAEF5F967B5D4E78AF1CAB3633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2656	3z5A0fnBE6.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3z5A0fnBE6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_acf04cc08aedf56675882323e4d3f33c_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 2656	5152	2026-09-08_acf04cc08aedf56675882323e4d3f33c_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 5152 wrote to memory of 984	5152	2026-09-08_acf04cc08aedf56675882323e4d3f33c_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-08_acf04cc08aedf56675882323e4d3f33c_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_acf04cc08aedf56675882323e4d3f33c_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Users\Admin\AppData\Local\Temp\3z5A0fnBE6.exe
  "C:\Users\Admin\AppData\Local\Temp\3z5A0fnBE6.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3z5A0fnBE6.exe

Path C:\Users\Admin\AppData\Local\Temp\3z5A0fnBE6.exe
Size 17.0MB
SHA256 02b101676d781d89d711f1a8e8a7d95f6fcbcbb2b614cbc94a6a45cd66710ce0
MD5 bbe297967497e1848b5e3524f742c271
SHA1 52a1aa0d75c3f373ea594cd4180856c12ee7077a
SHA512 af09876a68a44b23106cc2683c3f98afc5873490c61c3b2181b6fb23fb593ffb3844d7a3a707f2ac3d77aa60ce90f91418f56798f1cae3637bafb016c19c357b
SSDEEP 393216:2lFyfLPHiRE5bx5DMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcB:AUbx5yhpKOxk6lFU
TLSH
T196073319B792D8A5C8301B7C20686313813E1E434F55AAEF5E927B5D4E78AF1C9B3633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 455871e5691d7dc0b231688ad912f69eb35a1ec79e9b3db3fd64acc7633366bf
MD5 1c1382b8daabd2fab6a44b78454fda93
SHA1 c650bd63928b75cff3497020da7f1ac5cdac52a6
SHA512 c64bd0b1daeccb53299a8afc95007cc0bf9bd8c72fef0898dde76316bf55452129d2be791ea2f7494f948b3268611ac296b4e23d84ddb008448a6ee3375f5b99
TLSH
T18CE0260B06A985190106202B03F7274BDAA8184B1B90FBC25328521978C306DA9F1B81
MD5 SHA1 SHA512 TLSH