0cc05611050b7b0d4410f720b224ee52f0a32845d3db1ed23fac625574c486ce

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_82e05c6f1640df8733f3561865d832f1_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 14.0MB
Sample260919-3wwdvsvy2n
SHA256 0cc05611050b7b0d4410f720b224ee52f0a32845d3db1ed23fac625574c486ce
MD5 82e05c6f1640df8733f3561865d832f1
SHA1 088becf799887baa794eaa8e3e3aa4cea2c7a0fb
SHA512 23e4874fea32c2921275918ba6093e8899865377abb5fd146c17dc83ba9e2bcc181f7f133c1f88e46e93a2ac7f354d0bbf3a27bf42d130b9d33863bf78fe33dd
SSDEEP 393216:2lFyfLPHiRE5bxleIRVlFvlQCcv6QaAu5SVDk:AUbx/lFiPvQ6o
TLSH
T1DEE62306B7929CB5C8305B7C20246313813E1E434F69AEEB5E967B594E78AF1C5B3633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4448	KmUsDnW0.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_82e05c6f1640df8733f3561865d832f1_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KmUsDnW0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4448	1228	2026-09-19_82e05c6f1640df8733f3561865d832f1_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 1228 wrote to memory of 4764	1228	2026-09-19_82e05c6f1640df8733f3561865d832f1_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-19_82e05c6f1640df8733f3561865d832f1_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_82e05c6f1640df8733f3561865d832f1_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\KmUsDnW0.exe
  "C:\Users\Admin\AppData\Local\Temp\KmUsDnW0.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KmUsDnW0.exe

Path C:\Users\Admin\AppData\Local\Temp\KmUsDnW0.exe
Size 17.0MB
SHA256 8bc06ba9abe5221a437eb0450b7e8ce29231288534578d1b83fc06be7d228a6b
MD5 69c4e84a30c4f08e530f0ede06147464
SHA1 509424c1156f4e5c4114d1b7a6ed5107db5bee4a
SHA512 c4488e7992588132435c28f913484aea9e024e23700e24acb2f6b24234491f417872b1e3d7e95459cc0acab1fc3303ca4f11343daa6d14768e7bc35ef01d9308
SSDEEP 393216:2lFyfLPHiRE5bx3Vrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5Sl:AUbxFpKOxk6lFiPvQI
TLSH
T18007330AB792D861C8306B7C20286317813E1D434F65AAEF5F927B5D4A78AF1C9B3573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 e8b092c2462487c5520d54fe3537ec69d1245c7dcc4d17fa664160fc6e18999d
MD5 fb7fa16bd0f650f5f78e744c1e77bd02
SHA1 dab9beb20e505ddd56a3866b7a7cf4dd48571d34
SHA512 3da716cec19620db8bdd424ebb936690867e04a8a6b3cd70a0cab751c1ebec59001c091016da16d03fa31632704debc9d6df9771e30b8589ec18818c510e1605
TLSH
T135E0C6670A628900141AB0AF43FF3B8AD80820A7AA20FBC083400A5939C308C21F4286
MD5 SHA1 SHA512 TLSH