9d24f2bca72b3c6584cce33c44786e177e901c3253cc9cfd8c69457cba53a07e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 15.0MB
Sample260919-wsf2fazz2j
SHA256 9d24f2bca72b3c6584cce33c44786e177e901c3253cc9cfd8c69457cba53a07e
MD5 fc3545bbe6e5c0b31e6b89479254d225
SHA1 2f6714d30a2f74ad2af13965581ab699dd927ee3
SHA512 c9dd3d2cc7d241f2cd4158c555c38d182871a31dd007a88f6f5efcfe14fb80c49abb70c79289abbe1d8ca242e64f6696c849454ace9e1be3cb894b681c6e94a3
SSDEEP 393216:JK6HiRE5bxIQaAu5SVDMTNSG/lVrl3KExL3JzATzC8Wfe2:AUbxxvQ6yhpKOxkS
TLSH
T146F62312B79158A6DC749F7C0419A303403F2E47CE98ABEF3FDA37694A715F189B6902
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4588	FDRZWo1t.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDRZWo1t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4588	392	2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88
PID 392 wrote to memory of 3496	392	2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\FDRZWo1t.exe
  "C:\Users\Admin\AppData\Local\Temp\FDRZWo1t.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FDRZWo1t.exe

Path C:\Users\Admin\AppData\Local\Temp\FDRZWo1t.exe
Size 22.0MB
SHA256 f2f89afc38a586f5353fcedf326e1caecfb80c8524a6378e7ccc10322c904c51
MD5 427effb375d49bbd729d26304134da17
SHA1 d278a96a026c6239d411e9d8dbe9311257a94146
SHA512 28939762615914eefa14376faa6474209618e3e46a9fbb94fd17a1208b4c7bd7d926093f185bc55cab3d5b0c10fe04ad2a6c3d2e4bd48810f4201a928ae53b20
SSDEEP 393216:JK6HiRE5bx9VlFvlQCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlI:AUbxPlFiPvQ6yhpKOxk6lI
TLSH
T13F373322B79158A2DCB49F7C04196303403F2E47DE98AFEF3BD637A949715F089B6852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 1fee1a9841c8ccbc746e50c1d9f177d55628be1ad735650ec12f79de8f8a8e58
MD5 a2a025efe18e6e87b49c4aa2cd723c69
SHA1 cfd6464558fba7775987c11741b90f1b3970ff6a
SHA512 0e4514de9e6c40185acba3cde1ce05831c953b4a286b1b05a3c7cc45dcaab570796e83e9786577d5182cf658a48b7f5f2d06c5f019d63dab5f5bad61ee212c05
TLSH
T106E026071865CF04054DB01F16FF778EF828489B2E06FFC0D3A146396AC314EA2FA29A
MD5 SHA1 SHA512 TLSH