ed1099ff4725fa023eca100c236e53dba5c58c3221624b0431198500fb78e633

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 13.0MB
Sample260910-rr3ftsyvhy
SHA256 ed1099ff4725fa023eca100c236e53dba5c58c3221624b0431198500fb78e633
MD5 84dbfce06e3d545abc5439cb97930173
SHA1 2f02dec48289dad63826fe8d71227106f87c8e7c
SHA512 3fc5e0b92998c94391eefa5a6ce68db89b17b293a186590ec0f882406db26a5414b377713cc023db15408038a668490eee581259304fa44bfb608d042c5b7c90
SSDEEP 393216:2lFyfLPHiRE5bxH6QaAu5SVDMTNSG/lVrl3KExL3JzATN:AUbxHPvQ6yhpKOxc
TLSH
T197D62305B792DCA5C8305B7C2068A313813A1D038F55AAEF5F967B5D4E78AF1C9B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	oTC8VhKWe.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oTC8VhKWe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 4768	724	2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 724 wrote to memory of 3420	724	2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\oTC8VhKWe.exe
  "C:\Users\Admin\AppData\Local\Temp\oTC8VhKWe.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 05e795183bf74d54e5cfabba51d6c5f8fae02ed633197824fa7ccd1cd4fbe552
MD5 98fcb680e9f45247c821fc357d8a0cb5
SHA1 33169e080bfadaa7cb0d476fe10eeda332a426cd
SHA512 f3160fa908d401a07ee2983136b660b47cb74724462e5e40d9416cfd232f83597251fade255320873d8d91bc72d00517f0edd38f7cad518c8898aef4e446803f
TLSH
T195E0260B0425A6013009785F02F726CEE82968CB1B49FBC0A314492B78C650EAAF9B8D
MD5 SHA1 SHA512 TLSH

Submit Download

oTC8VhKWe.exe

Path C:\Users\Admin\AppData\Local\Temp\oTC8VhKWe.exe
Size 15.0MB
SHA256 b0b25ba9a6a2cfdfd088fcbfe61c7595003c71501e7306a19ce24c1fec763115
MD5 0f23862785d662b4147e439696128ea2
SHA1 c95d3f5a982d038869c01df87a05653d2650b89d
SHA512 cb5bf4d336e369783127d4bed18bb6d6adfed8f79d19c16e400329906c014243b480a274b4907a5d2a89c635a2026c9e67dd96c8d723bf079f95072a0e434bd2
SSDEEP 393216:2lFyfLPHiRE5bxFAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVv:AUbxOQ6yhpKOxk6v
TLSH
T16BF62305B792DCA5C8301B7C20686313813E1E034F55AAEF5E967B5D4E78AF1CAB3636
MD5 SHA1 SHA512 SSDEEP TLSH