48efa0bfbfc058da6ab2fc7819b2c75cae7de094a02c2460e665280bb2486f9e

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 18.0MB
Sample260922-rxn6dsxalg
SHA256 48efa0bfbfc058da6ab2fc7819b2c75cae7de094a02c2460e665280bb2486f9e
MD5 227a006532aae7127d323b1b40e60b25
SHA1 60e3c9462751f84e99ac5bd2be4ec116463b92a5
SHA512 fdc01cd3cc339a72522921591b4174c7366263bdaf154d264c368c1f0954cfc1806e75df1f8f4d922ffe59d57e15b8b6f1a8ff584d37d1a3c3883e5b6db8b33e
SSDEEP 393216:2lFyfLPHiRE5bxnCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVL:AUbxJPvQ6yhpKOxk6L
TLSH
T172173309B7929C65C8305B7C20686313813E1E034F55AAEB5F967B5D4E78AF1CAB3633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
856	0KaZYEqf7.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com
26	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0KaZYEqf7.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 856	4552	2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe	86
PID 4552 wrote to memory of 2568	4552	2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\0KaZYEqf7.exe
  "C:\Users\Admin\AppData\Local\Temp\0KaZYEqf7.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0KaZYEqf7.exe

Path C:\Users\Admin\AppData\Local\Temp\0KaZYEqf7.exe
Size 12.0MB
SHA256 1ab013edb7a32c8740e5202ac7136b55f03721b8fb7cbd839151eba67193fe47
MD5 e3c9720c9e61191fb1eb191f0cf61060
SHA1 54964fbcb56736f484d1defd4238c3525e89b8d2
SHA512 6aafae78acdf881579deb0642aed0ff1b2130501aa3e8a2b10be8bc3b23af40d113093f0225dbbf0a3e5fd9c2a3586d444e938be930bf186717cc7568f1fd399
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bx6QaT0u5SHvOYDMVByQyVG/uzGNVyAl3K8fCGnbP3Jzr:2lFyfLPHiRE5bx6QaAu5SVDMTNSG/lVZ
TLSH
T1BDC62305B792DCA5C8305B7C2068A313813A1D038F55AAEF5F967B5D4E78AF1C9B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 b4b1eb548acceefb016c45513fbc45eb0964eda8a0751db87d3ac6de434ca424
MD5 03a6f92db2354892810a6e07d2847e12
SHA1 9fe2d299d6f2141fdc1f51ddbfa2ae5e28163335
SHA512 f295a63c1e09c99f462337e9caf99649338d4e1063342cfc94056f77ec2eeec284e41a2abd6bbaaa2450211fb84ed3c83cf0f542aaeccdb87ea9a997b4397463
TLSH
T180E0264B74E8C680020931A702E72B79E8A40DDF2A94BBC04329611A2DC728DB5F6794
MD5 SHA1 SHA512 TLSH