d775de1b515de14a38d4a018e47c6ae58b4f40a7746d627f5341ad3f524e5957

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 16.0MB
Sample260913-eacsmabr8x
SHA256 d775de1b515de14a38d4a018e47c6ae58b4f40a7746d627f5341ad3f524e5957
MD5 353bd018258f9c6d6d39590b47037055
SHA1 887d50200b3a6048ead7965e82fe82a5c2932774
SHA512 4294c0f23441ac200cb382b79025faa1566be96a503dca959857e5c3bf6b4779b0b2ddec1d62046c47cc640101fb261f1765b50050ca72dfe0635ed781ee89c0
SSDEEP 393216:2lFyfLPHiRE5bxkDMTNSG/lVrl3KExL3JzATzC8WfeIRVlF2:AUbxkyhpKOxk6lF2
TLSH
T178F63305B792DC65C8301B7C20686313813E1E034F55AAEF6E967B5D4E78AF1CAB3636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4896	VdZ2bqSr.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VdZ2bqSr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4896	4956	2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe	83
PID 4956 wrote to memory of 6064	4956	2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\VdZ2bqSr.exe
  "C:\Users\Admin\AppData\Local\Temp\VdZ2bqSr.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VdZ2bqSr.exe

Path C:\Users\Admin\AppData\Local\Temp\VdZ2bqSr.exe
Size 12.0MB
SHA256 2d1de0e7a501d0f612102a25b481552463a347133ed04f091f98d51f6a997433
MD5 7724d8d3e0980ecb74bfcc30affc6ef3
SHA1 95181352b35a6f39985b61ba17a47d04619d219a
SHA512 bace69344ce11ea52111dbaae6264624a494f7aab2574776c799b0ac64acc09170cc8b82908b1000332093a31da3fe244bda28c0d492ac4da488e7d41d726617
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxjvQaT0u5SHvOYDMVByQyVG/uzGNVyAl3K8fCGnbP3Jq:2lFyfLPHiRE5bxrQaAu5SVDMTNSG/lVA
TLSH
T1CEC62305B792DCA5C8305B7C2068A313813A1D038F55AAEF5F967B5D4E78AF1C9B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 a264ba98c49c22e83ff525859f03267c7693ef538d9b541dd2a9e05603105aa4
MD5 15acc3d6130643fdb951c9e23f5bbdf2
SHA1 cc4a63c753d2f53517439540027237af97e99fb8
SHA512 943261ce424c52470f1bbcf41dc9fb222264e7720597fe068c9050cd3accb85cd4a50b0c336404c4010797e236948d0f30d56a238064b397520db6c4f4e08b4c
TLSH
T18EE0260B08748D40120A306B53E72B5ADDA86ED72A80FBC083619D3925C382DAFF2784
MD5 SHA1 SHA512 TLSH