f2aa53284a98de60bab7c085218c38f01d41a0d98e25e94cff7aaa5e34006a43

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_9ccaad15fcd497b7df9423235b38cc1c_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 10.0MB
Sample260922-ndmaxavaqh
SHA256 f2aa53284a98de60bab7c085218c38f01d41a0d98e25e94cff7aaa5e34006a43
MD5 9ccaad15fcd497b7df9423235b38cc1c
SHA1 ab5ae557b5f0549fe315502b7fab79cf73526aed
SHA512 265a935ded29ce450c48fd38fcec94350c15e49f2b6cec4e4f9ab5b643a43f6d90aaf142254737afc15b84fc578e8d16d779b24e0b449d9821e6adff87f4e6dd
SSDEEP 196608:JZ872k1AeAi2KOld5bxR/CGnbP3JzATC4C8WfszNpiRVxKv:JK6HiRE5bxZxL3JzATzC8WfeIRVg
TLSH
T1FBB62322B79258A2DC74AF7C04196303413E2E47CE98AFEF3AD63B6D49715F08977852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4188	VbzV9FePY.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_9ccaad15fcd497b7df9423235b38cc1c_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VbzV9FePY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4188	2568	2026-09-21_9ccaad15fcd497b7df9423235b38cc1c_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 2568 wrote to memory of 3384	2568	2026-09-21_9ccaad15fcd497b7df9423235b38cc1c_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-21_9ccaad15fcd497b7df9423235b38cc1c_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_9ccaad15fcd497b7df9423235b38cc1c_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\VbzV9FePY.exe
  "C:\Users\Admin\AppData\Local\Temp\VbzV9FePY.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VbzV9FePY.exe

Path C:\Users\Admin\AppData\Local\Temp\VbzV9FePY.exe
Size 23.0MB
SHA256 33afdf2159921b90824338d0c8b264550d5a70879bd3c3a27a08b71010e417c8
MD5 67d05fa7f3b5d34ffa406c3e5627ce73
SHA1 52facbe5b0c59d976d30e1765e273a19716ad45a
SHA512 64c253555d6190b53077eff3ca475ad097d0bdef6feeefb40edde3802691d480a5af42d8dac11af957fe48cf40622bb3d4369339f119d120c5f29677c7885049
SSDEEP 393216:JK6HiRE5bxE6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5E:AUbxEPvQ6yhpKOxk6lFiPvQE
TLSH
T19A373322F79258A6D8749F3C04196303403F2E47DE98AFEF3BDA37694A715F08976942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 02cb59d8e0d85441a38045a8aa2a4731d4182aa72660fa88c17d54b7f5c4d1a7
MD5 3484f9dee0eecaeef3420e21ab7392c1
SHA1 a4b063247e75f263f86695d568ed04837d8429b7
SHA512 8da658a6642590aa76316fd181452c7e9b61a6a2f3eb924e9b7c3c6b6c6496e8a4b4f3d20af6de9ced3ad61fd14eae2bc9d5182e4424f0f983d2a5c42d73449b
TLSH
T188E0264B05F986400405711702F7268BEE54588A1E52BFC18798C21D3DC344CADF23A1
MD5 SHA1 SHA512 TLSH