e3b365f670b9845964e744dfc01494aa70c7cfb643d13d16f9926e4ea64c882e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_44406a86039410344cac681d53fe07b6_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 10.0MB
Sample260913-c8gs5aeb32
SHA256 e3b365f670b9845964e744dfc01494aa70c7cfb643d13d16f9926e4ea64c882e
MD5 44406a86039410344cac681d53fe07b6
SHA1 7b6371e050d33a92495a60538584b244fbb21092
SHA512 b80f963568b988b83f9803288f8adbcea00a3d6f873171ea5b6a9755fc542eb36744705f252d64ddf7e03105b7ce7bd1b22cddf71d6f10973e89b82c1c043c83
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxrJzATC4C8WfszNpiRVxK65Dj:2lFyfLPHiRE5bxrJzATzC8WfeIRVlFj
TLSH
T1E2B62306B792D865C8302B7C20686313823E1D434F65ABEF5E967B5D4E78AF1C9B3532
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5584	5G4LEWVXw1u.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	pastebin.com
1	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5G4LEWVXw1u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_44406a86039410344cac681d53fe07b6_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 5584	4072	2026-09-12_44406a86039410344cac681d53fe07b6_darkgate_elex_luca-stealer_mespinoza_njrat.exe	87
PID 4072 wrote to memory of 4820	4072	2026-09-12_44406a86039410344cac681d53fe07b6_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-12_44406a86039410344cac681d53fe07b6_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_44406a86039410344cac681d53fe07b6_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\5G4LEWVXw1u.exe
  "C:\Users\Admin\AppData\Local\Temp\5G4LEWVXw1u.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5G4LEWVXw1u.exe

Path C:\Users\Admin\AppData\Local\Temp\5G4LEWVXw1u.exe
Size 22.0MB
SHA256 43e46c83f74a2394e12c4a5b1127d587133d85aa6126fb28d851e4972892d9b2
MD5 13cb27aad7e7a3e4c7f9e76046c423bc
SHA1 b984790f23bd21b3f239a27ec93926715f018596
SHA512 1785ac2c0111e24efa214242afe48d742ae45317bc37408b9bd416ac0d6dc9f6f2979611dacafb6636c1490a62a50ca335c74b5a001647ab6677301757672799
SSDEEP 393216:2lFyfLPHiRE5bxERVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRV6:AUbxKlFiPvQ6yhpKOxk6lo
TLSH
T121373305B7A298B5C8301B7C10686313813E1E434F55AAEF5F967B594E78AF1CAB3633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 f9b3533e7a51f2b40e8eeb41dcf5536c6967ef54a41a7b96108e94c1e8e02666
MD5 610b62dae0f3264bac2aeef36387eaeb
SHA1 a4cc603bf4e66fde56e2b71b35d07a211d80c710
SHA512 cdfbd97475f1eb896ac05c4493af89bab500f20eca0a2380dffb2871b9f447f791e1c5032031b8ab238fe4a3cc74dd4373034a98fe4c1fc37f5c9aa982ad1eb0
TLSH
T134E0260740288E041209309F03F72A9AF918A6471B28FBC283D29A9928D611C6AF5388
MD5 SHA1 SHA512 TLSH