04929a3058d1a43e4878d35dd4f719a54e9062dd3b946470faa6c5f9ccff8b2f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_9bd00cbf93d7e8f6a0315a358a180d3d_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 15.0MB
Sample260919-2mkqbscc87
SHA256 04929a3058d1a43e4878d35dd4f719a54e9062dd3b946470faa6c5f9ccff8b2f
MD5 9bd00cbf93d7e8f6a0315a358a180d3d
SHA1 da965377e2da2542b642e6d596f0c4532b9d431e
SHA512 90c065d51b0912f0335096709a7d168e464f98e3848e4443294ea82432ec7587ceceaa7394598eb2b42bb41972e0df8dd8efa48c06ff9ec66bded1c7aba48325
SSDEEP 393216:JK6HiRE5bx+G/lVrl3KExL3JzATzC8WfeIRVlFvlQCcc:AUbxlpKOxk6lF1
TLSH
T150F62322B79258A2D874AF7C04196303403F2E47DE98ABEF3BD6376D4A715F08977852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
984	4D3MgXEuvL3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_9bd00cbf93d7e8f6a0315a358a180d3d_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D3MgXEuvL3.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 984	4468	2026-09-19_9bd00cbf93d7e8f6a0315a358a180d3d_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88
PID 4468 wrote to memory of 484	4468	2026-09-19_9bd00cbf93d7e8f6a0315a358a180d3d_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-19_9bd00cbf93d7e8f6a0315a358a180d3d_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_9bd00cbf93d7e8f6a0315a358a180d3d_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\4D3MgXEuvL3.exe
  "C:\Users\Admin\AppData\Local\Temp\4D3MgXEuvL3.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4D3MgXEuvL3.exe

Path C:\Users\Admin\AppData\Local\Temp\4D3MgXEuvL3.exe
Size 13.0MB
SHA256 66d73c9a6c33fc21628f0494afa9e1c8101d06d19cbd8b0978c71a5367865e9b
MD5 756afb976d5cf18252a4f1c44cc35ee0
SHA1 09de0c95d337885d18ce3e97c91e36fd13523aad
SHA512 58ebd1753b505dea1361272c76accc43803a00945994e21f0e5b18cb4168568ea8c5d685c4d074767c2c28677816d7fa10d8c0664a47dd48cac2562f71274932
SSDEEP 393216:JK6HiRE5bxRL3JzATzC8WfeIRVlFvlQCcC:AUbx5xk6lFz
TLSH
T10DD62322B79258A2D874AF7C04196303413F2E87DE98AFEF3AD63B6D49715F08977442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 f849958f49e8099a79c53996daaf57482a3e8fdf4f847914c4a390e8196c0365
MD5 61d68eb9cb9ad4935e0e875a78c99140
SHA1 989af5cec09bef9850ec27b9fb566302fcaa03e7
SHA512 e529ef1a6a6af0e5b3d6dd55a9058ff4ca179e4e11e96d8711aa54e3c612fee64d98cad3b0e8941c4983302d64b7efe31a93fb620ad7563a9d2b9b04ae7dec52
TLSH
T1F7E0264F54248E44154AA05F12FF1B9AF8784A8B2A50BFC0A35152293DC610CA9F3298
MD5 SHA1 SHA512 TLSH