3b0f29295f96d853c0c5797ff2415b9934a888c7c3def318e84fb71e34276af1

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_b4e125a9e0d83af34dc57790e3327a9e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 19.0MB
Sample260912-xwdwxsshle
SHA256 3b0f29295f96d853c0c5797ff2415b9934a888c7c3def318e84fb71e34276af1
MD5 b4e125a9e0d83af34dc57790e3327a9e
SHA1 9f43e8b7442f1477bc5d1396c770effcc4d0c53f
SHA512 10f4b8575b2087da844b6fa4eeb603fe392b2a088820715aae2c207e9ea8ed5e5d4ddc924fa72c67b96f85f83bcffdb955c7f49f65c11aef569d66c247e125e5
SSDEEP 393216:JK6HiRE5bxWDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5Sp:AUbxWyhpKOxk6lFiPvQA
TLSH
T1B0173322B79258A6DC749F7C041D6303403F2E47CE98ABEF3BD637694A725F08976852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4772	VuRUYuZrqJA.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VuRUYuZrqJA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_b4e125a9e0d83af34dc57790e3327a9e_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4772	2412	2026-09-12_b4e125a9e0d83af34dc57790e3327a9e_darkgate_elex_luca-stealer_mespinoza_njrat.exe	86
PID 2412 wrote to memory of 4572	2412	2026-09-12_b4e125a9e0d83af34dc57790e3327a9e_darkgate_elex_luca-stealer_mespinoza_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-12_b4e125a9e0d83af34dc57790e3327a9e_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_b4e125a9e0d83af34dc57790e3327a9e_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\VuRUYuZrqJA.exe
  "C:\Users\Admin\AppData\Local\Temp\VuRUYuZrqJA.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VuRUYuZrqJA.exe

Path C:\Users\Admin\AppData\Local\Temp\VuRUYuZrqJA.exe
Size 13.0MB
SHA256 d8404e9327241d017497ce209f8a6d7defc401b6c21c0210f54d6d33a9b4ed4e
MD5 4033a02cfb5b4cc52d30fe13fc0796c5
SHA1 43f3f404441f51bd52a129a485509b774f0f2743
SHA512 92a6f214db0377dd598a0897014d6a9a465f82362d1364a3da401a43dc7f78ed9577020319a2fd95c1f6d20a4776bc66230a0b7884c9d5e8ae2e5b793a2bb47b
SSDEEP 393216:JK6HiRE5bx3FvlQCcv6QaAu5SVDMTNSG4:AUbx3FiPvQ6yq
TLSH
T19AD62312B79158A6DCB49F3C0019A303403F2E87DE98AFEF2BDA376D4A715F08976552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 8ccc5422e8ae347052a7f170bd9321a6ef3259b85c7b5b1eaabe4740765d86be
MD5 62c8956412f49fc3e3c9f8b68804eafa
SHA1 cda888300b74e47ed074b09406e1f6022067ee91
SHA512 c77387383f3ef7c89be0246a65a21377332a686aba293991521d97b33439603f7bb6c2a8098ed1f2a94de29c2b5e17ebd94ff840e45338eb2cba92c551fddd04
TLSH
T18FE0260F1138C7843409F4EB13F7166BD938346B1A92BFD04356623935C211C61FAA88
MD5 SHA1 SHA512 TLSH