48efa0bfbfc058da6ab2fc7819b2c75cae7de094a02c2460e665280bb2486f9e

Analysis

max time kernel
149s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 18.0MB
Sample260922-rxn6dsxalg
SHA256 48efa0bfbfc058da6ab2fc7819b2c75cae7de094a02c2460e665280bb2486f9e
MD5 227a006532aae7127d323b1b40e60b25
SHA1 60e3c9462751f84e99ac5bd2be4ec116463b92a5
SHA512 fdc01cd3cc339a72522921591b4174c7366263bdaf154d264c368c1f0954cfc1806e75df1f8f4d922ffe59d57e15b8b6f1a8ff584d37d1a3c3883e5b6db8b33e
SSDEEP 393216:2lFyfLPHiRE5bxnCcv6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVL:AUbxJPvQ6yhpKOxk6L
TLSH
T172173309B7929C65C8305B7C20686313813E1E034F55AAEB5F967B5D4E78AF1CAB3633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5088	hXluWvcuh.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hXluWvcuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 5088	3584	2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 3584 wrote to memory of 2192	3584	2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_227a006532aae7127d323b1b40e60b25_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\hXluWvcuh.exe
  "C:\Users\Admin\AppData\Local\Temp\hXluWvcuh.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 b4b1eb548acceefb016c45513fbc45eb0964eda8a0751db87d3ac6de434ca424
MD5 03a6f92db2354892810a6e07d2847e12
SHA1 9fe2d299d6f2141fdc1f51ddbfa2ae5e28163335
SHA512 f295a63c1e09c99f462337e9caf99649338d4e1063342cfc94056f77ec2eeec284e41a2abd6bbaaa2450211fb84ed3c83cf0f542aaeccdb87ea9a997b4397463
TLSH
T180E0264B74E8C680020931A702E72B79E8A40DDF2A94BBC04329611A2DC728DB5F6794
MD5 SHA1 SHA512 TLSH

Submit Download

hXluWvcuh.exe

Path C:\Users\Admin\AppData\Local\Temp\hXluWvcuh.exe
Size 23.0MB
SHA256 49bc103a087657828ccb3f7a5e7d8f1a1f193dc9b4c6d0a2522e750317902c28
MD5 91f635c5ae701f1ef6ddccac7d7a7a7c
SHA1 10e47553f0f590b71bd91574114e39d7b2e0ca5b
SHA512 a5e594207bcd9ed79c14b8621d245e467741a257a7fec1e2e1621dffb884ef82ccd3931f4c5ca0ecf0751702b97d76bfbea25f01885136fae665ad5dde58550c
SSDEEP 393216:2lFyfLPHiRE5bxs3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KExL3JO:AUbxsxk6lFiPvQ6yhpKOxk1
TLSH
T1CC37330AB792DC65D8301B7C20286313413E1D434F65AAFF5E967B594E78AF1CAB3623
MD5 SHA1 SHA512 SSDEEP TLSH