d775de1b515de14a38d4a018e47c6ae58b4f40a7746d627f5341ad3f524e5957

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 16.0MB
Sample260913-eacsmabr8x
SHA256 d775de1b515de14a38d4a018e47c6ae58b4f40a7746d627f5341ad3f524e5957
MD5 353bd018258f9c6d6d39590b47037055
SHA1 887d50200b3a6048ead7965e82fe82a5c2932774
SHA512 4294c0f23441ac200cb382b79025faa1566be96a503dca959857e5c3bf6b4779b0b2ddec1d62046c47cc640101fb261f1765b50050ca72dfe0635ed781ee89c0
SSDEEP 393216:2lFyfLPHiRE5bxkDMTNSG/lVrl3KExL3JzATzC8WfeIRVlF2:AUbxkyhpKOxk6lF2
TLSH
T178F63305B792DC65C8301B7C20686313813E1E034F55AAEF6E967B5D4E78AF1CAB3636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1296	9DoRaSbHYNB.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9DoRaSbHYNB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 1296	5408	2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88
PID 5408 wrote to memory of 4588	5408	2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_353bd018258f9c6d6d39590b47037055_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Users\Admin\AppData\Local\Temp\9DoRaSbHYNB.exe
  "C:\Users\Admin\AppData\Local\Temp\9DoRaSbHYNB.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9DoRaSbHYNB.exe

Path C:\Users\Admin\AppData\Local\Temp\9DoRaSbHYNB.exe
Size 10.0MB
SHA256 e8b9c0ea85c84c0592c917f1177648084893da734dd63e99b26c3d321a8a40ec
MD5 9a3585d68d4cfd04ed35e99428ea0025
SHA1 473f5753426e626f0094337daf31e95b9f4626f0
SHA512 187c413649e491bedaec5e2d0aedc82cbbbace5c127796e5f736c2bdb7566a2182fe38e6e84b3370170fcdfa6ceb39422f04d8746610ba6e971604ab16bfed45
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxQsJcQvQaT0u5SHvOYDMVByQyVG/uzG/:2lFyfLPHiRE5bxS6QaAu5SVDMTNSG/n
TLSH
T11FB62305B79299B5C8301B7C2024A313813E1E434F656AEF5F967B5D4E78AF1CAB3632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 a264ba98c49c22e83ff525859f03267c7693ef538d9b541dd2a9e05603105aa4
MD5 15acc3d6130643fdb951c9e23f5bbdf2
SHA1 cc4a63c753d2f53517439540027237af97e99fb8
SHA512 943261ce424c52470f1bbcf41dc9fb222264e7720597fe068c9050cd3accb85cd4a50b0c336404c4010797e236948d0f30d56a238064b397520db6c4f4e08b4c
TLSH
T18EE0260B08748D40120A306B53E72B5ADDA86ED72A80FBC083619D3925C382DAFF2784
MD5 SHA1 SHA512 TLSH