e3aeb90e61654a34c0599260ad39a864b083f0a312ffd86f7ef17e81bf4bc96b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_925a3dc0f43851dffcbd19ce0ae288f5_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 18.0MB
Sample260919-23wsjace28
SHA256 e3aeb90e61654a34c0599260ad39a864b083f0a312ffd86f7ef17e81bf4bc96b
MD5 925a3dc0f43851dffcbd19ce0ae288f5
SHA1 b552c1f6d39781f0d5769330dc3011f67bb297c0
SHA512 84252cc0472ad533f612c081d6e5b01fe44c40f3c2bf315d9a1ec11e5e4b509680ac801270de8700d6c02f633b9418a4fb1fc660c02309542d57d6d25f503b6b
SSDEEP 393216:2lFyfLPHiRE5bxArl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SE:AUbxMpKOxk6lFiPvQd
TLSH
T11817330AB7929C65C8305B7C20286313813E1D434F65AAEB5F967B5D4E78AF1C9B3633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3732	tEjfQaeHIoxZZ.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_925a3dc0f43851dffcbd19ce0ae288f5_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tEjfQaeHIoxZZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3732	4768	2026-09-19_925a3dc0f43851dffcbd19ce0ae288f5_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 4768 wrote to memory of 1160	4768	2026-09-19_925a3dc0f43851dffcbd19ce0ae288f5_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-19_925a3dc0f43851dffcbd19ce0ae288f5_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_925a3dc0f43851dffcbd19ce0ae288f5_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\tEjfQaeHIoxZZ.exe
  "C:\Users\Admin\AppData\Local\Temp\tEjfQaeHIoxZZ.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 400c370cd6f12b4ec050a444f533b0d28e3a228b205be6f91f9b9f322b52d916
MD5 bf6eb2ab4bc7986d9196a4ecd045b58a
SHA1 643841fc6093623ccd63ea85160c08f6a689ddf2
SHA512 ed8ddc3e441572334d53f8a26c3a040dcf628c4c61ea92251ed00b875014ce958221612703035747e67729ebd6c7c7d36681fd5756e0adce48ee9b70c8c68b34
TLSH
T178E0268B89298A06050760AF12FF3B89DA2508471E45BFC09312811924D348CB9FABA4
MD5 SHA1 SHA512 TLSH

Submit Download

tEjfQaeHIoxZZ.exe

Path C:\Users\Admin\AppData\Local\Temp\tEjfQaeHIoxZZ.exe
Size 14.0MB
SHA256 317c8cbe8fff95446226a307ad28d2037859f87d1e7995d1c3ef232697ea9d2e
MD5 d25d85db3a95535d54e8e2c0d6c463ac
SHA1 d4145412b956c91ddb93b8a4aa3e369e1ab912e9
SHA512 c1f6786f7ed2e2e156734e5dd1ea3bd736f8f1e73440d149b56291a7e9eb5a3a888cc0b67a677dcb455802c9cbbf1cd9aef7801797bf251a43add1b006c74489
SSDEEP 393216:2lFyfLPHiRE5bxoFvlQCcv6QaAu5SVDMTNSG/lVrl3K4:AUbxoFiPvQ6yhpK4
TLSH
T172E62305B7A298B4C8301B7C20646313813E1E435F65AAEF5F967B5D4E78AF1C6B3632
MD5 SHA1 SHA512 SSDEEP TLSH