964827877395496328658d02cf25263e2f20eb5bb35756b35e0c548cf549e4a4

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_e5366dd349f7d0c7fb7f202b6b3bc6f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 15.0MB
Sample260920-3cacaavves
SHA256 964827877395496328658d02cf25263e2f20eb5bb35756b35e0c548cf549e4a4
MD5 e5366dd349f7d0c7fb7f202b6b3bc6f4
SHA1 c813f56194edbca758263e336f39278942b4c3a8
SHA512 36cf4eb528e3e8e5374d9431a5b3b1f2c7410bb4ae6b546e16f3b782bfdd81478bd9dedd9944efd3ac136d154402294abf8e5677ab0e6e7604947c36721698b3
SSDEEP 393216:2lFyfLPHiRE5bxGu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVF:AUbxGQ6yhpKOxk6F
TLSH
T150F62305B792DD65C8301B7C20686313813E0E034F55AAEF6E967B5D4E78AF1CAB7632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6052	2aSEtxhqc1ri.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-20_e5366dd349f7d0c7fb7f202b6b3bc6f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aSEtxhqc1ri.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 6052	1708	2026-09-20_e5366dd349f7d0c7fb7f202b6b3bc6f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90
PID 1708 wrote to memory of 4020	1708	2026-09-20_e5366dd349f7d0c7fb7f202b6b3bc6f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-20_e5366dd349f7d0c7fb7f202b6b3bc6f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_e5366dd349f7d0c7fb7f202b6b3bc6f4_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\2aSEtxhqc1ri.exe
  "C:\Users\Admin\AppData\Local\Temp\2aSEtxhqc1ri.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2aSEtxhqc1ri.exe

Path C:\Users\Admin\AppData\Local\Temp\2aSEtxhqc1ri.exe
Size 11.0MB
SHA256 efc9d8278b67ed150422e010b295b54ee3200b40f54677291423e8bc96f0da50
MD5 b9c9c3a51c7c00c30339926e211f0e23
SHA1 4f1297984abe937efcc1c687b310719ebc846373
SHA512 bea8374597276da8162f981a288c39a1b5f5577db9c12371da638987fe1dc78db3fb4c22b0276468dc6afc385e2401782bba960ea96e2c0a21b314714005e678
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxjT0u5SHvOYDMVByQyVG/uzGNVyAl3K8fCGnbP3J0:2lFyfLPHiRE5bxjAu5SVDMTNSG/lVrl0
TLSH
T12CC62305B792DCA5C8301B7C2064A313813E1E034F556AEF6E967B5D4E78AF1CAB3636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 612a66d54b20c9f51a3fd2b5deeda0a10c2be292ab01aadc7e22e93a85754c36
MD5 ac4528913ca04b20c22b0e406a14cc46
SHA1 c0fd330335a4df10af36ff3a1eaa30050137ee2a
SHA512 b96bbf990369f643159bf31a9f2307fb08f34d22c227a1a410c1c5a45362a8852b897b4704d279f054a598cb2f5fe9e032e116f58e5b3859919d7634bf949393
TLSH
T1A7E0C64B00798580040C202746EF1A8BD828208B2E00FBC0A320223FAAE221CA3F0B85
MD5 SHA1 SHA512 TLSH