bd001becd863bb52da3cb54bfe1772f63ef724daa0ffc9e5b70147a28760faf9

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c546bac06f10a99aac2ee18922ed5a4d_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 11.0MB
Sample260910-myzlassapa
SHA256 bd001becd863bb52da3cb54bfe1772f63ef724daa0ffc9e5b70147a28760faf9
MD5 c546bac06f10a99aac2ee18922ed5a4d
SHA1 3a4abae534f6ee1f3dc0353c963e9783d04ab941
SHA512 01bede73b961c79efa68f336fb891ce78e551692252b5fe4f9b72dae32f63a32ebb27b52d901b83e9243b26a35263f3dd80f90d27041af85a3aa5ec8c536df43
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxLC4C8WfszNpiRVxK65DzLlQCc+:2lFyfLPHiRE5bxLzC8WfeIRVlFvlQCc+
TLSH
T1EBC6230AB7929965C8302B7C20286317823E1D434F65AEEF5E927B5D4E78AF0C5B3573
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4580	X4ndgX0BFr0Po.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_c546bac06f10a99aac2ee18922ed5a4d_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X4ndgX0BFr0Po.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4580	1088	2026-09-10_c546bac06f10a99aac2ee18922ed5a4d_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 1088 wrote to memory of 4404	1088	2026-09-10_c546bac06f10a99aac2ee18922ed5a4d_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c546bac06f10a99aac2ee18922ed5a4d_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c546bac06f10a99aac2ee18922ed5a4d_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\X4ndgX0BFr0Po.exe
  "C:\Users\Admin\AppData\Local\Temp\X4ndgX0BFr0Po.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

X4ndgX0BFr0Po.exe

Path C:\Users\Admin\AppData\Local\Temp\X4ndgX0BFr0Po.exe
Size 17.0MB
SHA256 3d9bf6f2a3d1a50fa78e373515d7853de1a9c74d06714e7ce349ea64726d5019
MD5 93514972960fc544bf887cd6b57ea5fe
SHA1 2cdf57702f2dd9c3fb1d9cfdf205b21944289f28
SHA512 cd24141019c971d32291641cb3581341dd121ac129a0d1efec1e13016ef8cb277b7461f786b195c5cfa70cd73e8d854fbbc2cd0688b12c3142d380b75b54c918
SSDEEP 393216:2lFyfLPHiRE5bxGJzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTm:AUbxck6lFiPvQ6F
TLSH
T1EC07330AB79299B5C8301B7C20286313813D1E434F65ABEF5E967B594E78AF1C5B3633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 2f380b5209e15baa8591430499144d3b18909b2a0d2c112afac979a57ba01cf8
MD5 b1e388b381928bd27432e94c3cd52657
SHA1 d704c8736381e53f5a235c12f119082f90dee696
SHA512 7c51e9f7d766619a44818e097c11809dd543183fe9e8c59452ca5f391c73ee3fb825c610bc26a424f8a886cee8569a48b8317af3c367238f4decc0dd436331ae
TLSH
T188E0260785758F40221A61EF07E72BAAFE2914572B61FBC68320613A24CB51DADF1A8C
MD5 SHA1 SHA512 TLSH