efbdc4c589e608978054a4b914df2d207af95bd485655dc15bed6d3c803175a2

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_7d0e2c48c057a679abc819b9059f42b4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 19.0MB
Sample260916-yttp2afk5y
SHA256 efbdc4c589e608978054a4b914df2d207af95bd485655dc15bed6d3c803175a2
MD5 7d0e2c48c057a679abc819b9059f42b4
SHA1 4fdc813796f90e574c3774808f39c60f0bec46d9
SHA512 5555b4c3ecac28ec04c8c96887af6d603e56038e2b9dc70349a488da6ae945c886a6bba2d00019c8d057f35ce442db5d1f1e549b8dfa48df50a286c9d73da84d
SSDEEP 393216:JK6HiRE5bxgxL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVK:AUbxSxk6lFiPvQ6ys
TLSH
T17A173322B79158A6DCB49F3C04196303403F2E47DE98AFEF3BDA37694A715F08976942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2016	37Zp8s1nGaA.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_7d0e2c48c057a679abc819b9059f42b4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37Zp8s1nGaA.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2016	4232	2026-09-16_7d0e2c48c057a679abc819b9059f42b4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	87
PID 4232 wrote to memory of 588	4232	2026-09-16_7d0e2c48c057a679abc819b9059f42b4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-16_7d0e2c48c057a679abc819b9059f42b4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_7d0e2c48c057a679abc819b9059f42b4_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\37Zp8s1nGaA.exe
  "C:\Users\Admin\AppData\Local\Temp\37Zp8s1nGaA.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37Zp8s1nGaA.exe

Path C:\Users\Admin\AppData\Local\Temp\37Zp8s1nGaA.exe
Size 12.0MB
SHA256 479529d8ceb63562cc63c1e0b3eda18efda063a8b5e45161108653e5a7a6d9ae
MD5 b0bbb2f3f6d901fc64f3513a3e08a865
SHA1 b3a6be88be16ffa5ed113f23d3f85e74d47764ad
SHA512 52f856d84e0efafcb0333728a292c1aa7887665315c68ecdcf320498416cb794e9cb8539140d89c0d006c0ae7982db7c406dbbcb067e47758f8fa2e013bf4622
SSDEEP 196608:JZ872k1AeAi2KOld5bxRqK65DzLlQCcHsJcQvQaT0u5SHvOs:JK6HiRE5bxoFvlQCcv6QaAu5Sd
TLSH
T1BDC62312B79258A2D8B49F7C00199303403F2E87DE98AFEF2BDA376D4A715F08977552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 4dc60f6ff93df4ceda69beee2c7481dbbfa34c2cfeb6e1396bfbce937accd78d
MD5 baf5ef9b9d2ecbfff380c8214e433b01
SHA1 9975c173a25890864cef582b9627da8046fe29ea
SHA512 70a72442e283d893f257677f1af94ccd0a9390999f03110f6ab95e31ef0d32e4d446b4776727f71bfe0aa64e57f46db36fad726614f71d49a413783b45746637
TLSH
T116E0264B547989481405B02F12E72F8DDA2845672A44FFC26726829926C304C65F6A80
MD5 SHA1 SHA512 TLSH