9d24f2bca72b3c6584cce33c44786e177e901c3253cc9cfd8c69457cba53a07e

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 15.0MB
Sample260919-wsf2fazz2j
SHA256 9d24f2bca72b3c6584cce33c44786e177e901c3253cc9cfd8c69457cba53a07e
MD5 fc3545bbe6e5c0b31e6b89479254d225
SHA1 2f6714d30a2f74ad2af13965581ab699dd927ee3
SHA512 c9dd3d2cc7d241f2cd4158c555c38d182871a31dd007a88f6f5efcfe14fb80c49abb70c79289abbe1d8ca242e64f6696c849454ace9e1be3cb894b681c6e94a3
SSDEEP 393216:JK6HiRE5bxIQaAu5SVDMTNSG/lVrl3KExL3JzATzC8Wfe2:AUbxxvQ6yhpKOxkS
TLSH
T146F62312B79158A6DC749F7C0419A303403F2E47CE98ABEF3FDA37694A715F189B6902
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3136	H9uxrnhD8.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H9uxrnhD8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3136	1672	2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90
PID 1672 wrote to memory of 4776	1672	2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_fc3545bbe6e5c0b31e6b89479254d225_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\H9uxrnhD8.exe
  "C:\Users\Admin\AppData\Local\Temp\H9uxrnhD8.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

H9uxrnhD8.exe

Path C:\Users\Admin\AppData\Local\Temp\H9uxrnhD8.exe
Size 11.0MB
SHA256 406b1b9026c9f3016e15e43bd9b9666e65903751deb2c4551908be9b0cd3c6dd
MD5 bcbc92838aa183b5c0bafde245ecd3d0
SHA1 f54174d5c2b1bcb820ab5cd267e159832838d4a9
SHA512 ec1c6d3c10a969e1f126720bdc0ee1f80898804e9e4f4a0f29524f8564c155b91c5e8e893662a2f9e16ce2e1b862d68c5ace7b5373a3e428ab435823a2832a5b
SSDEEP 196608:JZ872k1AeAi2KOld5bxRdT0u5SHvOYDMVByQyVG/uzGNVyAl3K8fCGnbPy:JK6HiRE5bxfAu5SVDMTNSG/lVrl3KExe
TLSH
T117C62312B79158A6DC749F7C0019A303403F2E43DE98ABEF3BDA376D4A725F18976912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 1fee1a9841c8ccbc746e50c1d9f177d55628be1ad735650ec12f79de8f8a8e58
MD5 a2a025efe18e6e87b49c4aa2cd723c69
SHA1 cfd6464558fba7775987c11741b90f1b3970ff6a
SHA512 0e4514de9e6c40185acba3cde1ce05831c953b4a286b1b05a3c7cc45dcaab570796e83e9786577d5182cf658a48b7f5f2d06c5f019d63dab5f5bad61ee212c05
TLSH
T106E026071865CF04054DB01F16FF778EF828489B2E06FFC0D3A146396AC314EA2FA29A
MD5 SHA1 SHA512 TLSH