ac46009f826cabd961ef568d4b9b7aca4fcd68999b579321efcdfb550edbe0d3

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_224c23623f687feb2c4ec217ee32ceac_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 22.0MB
Sample260924-etzrhadg86
SHA256 ac46009f826cabd961ef568d4b9b7aca4fcd68999b579321efcdfb550edbe0d3
MD5 224c23623f687feb2c4ec217ee32ceac
SHA1 fdaa77a390383c4d9c385df6441b7d2155643db3
SHA512 b9d141dde941d9c4a29c1f0f9c527284aec270d0d8ab9da2662f362e47fa374425834a3025da4e1ca147e8ea531f19fb31b83c5c747d3f75b250f53b227c88dc
SSDEEP 393216:2lFyfLPHiRE5bx0l3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3u:AUbx0pKOxk6lFiPvQ6yhpKOk
TLSH
T15A373305B7A2D8A5C8305B7C20686313813E1D038F55AAEF6F927B5D4E78AF1C9B3527
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3876	KiHNSvPOBHjE.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_224c23623f687feb2c4ec217ee32ceac_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KiHNSvPOBHjE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 3876	988	2026-09-24_224c23623f687feb2c4ec217ee32ceac_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90
PID 988 wrote to memory of 5704	988	2026-09-24_224c23623f687feb2c4ec217ee32ceac_darkgate_elex_luca-stealer_mespinoza_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-24_224c23623f687feb2c4ec217ee32ceac_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_224c23623f687feb2c4ec217ee32ceac_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\KiHNSvPOBHjE.exe
  "C:\Users\Admin\AppData\Local\Temp\KiHNSvPOBHjE.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KiHNSvPOBHjE.exe

Path C:\Users\Admin\AppData\Local\Temp\KiHNSvPOBHjE.exe
Size 20.0MB
SHA256 45b2232039a4c30dcc547b634d16614459efb8a38560e96f74df7ad519ba6a58
MD5 5b2d5cdba3120957c4d600d7194e57ff
SHA1 4f605ee9499540fe3eb7915add5e5e964803be37
SHA512 a3ff00c8994127731a184df01f1669d63cd7703d07c5062af14777c6dd7c7576ca512fc77bbc900782bd936454330a0d294ec8e151aacd6c6c90327afd5df0c7
SSDEEP 393216:2lFyfLPHiRE5bx9L3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KEp:AUbxNxk6lFiPvQ6yhpKq
TLSH
T1FD273309B79298A5C8305B7C20286313813E1E434F55AAEF5F967B5D4E78AF1C9B3633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 401210e53fe659dc7fa8601b1b325c47e26173fa46f6cfd6192d960f71b230b4
MD5 e5e4304c979a88568b48c7bed81ba21a
SHA1 0574b36d0cdb61b08f49c6c916c774736a8a0898
SHA512 ffdce34efdbb0c994aa6df9c6a8bc7a02413d6309c9681aa6e83eb4706e8f4d0c561cbcfddee635402c9b9621d9a1791f98655622c001b760710675064c654a4
TLSH
T18CE0208765E5C6400005705B02F73B49D45408DA2505FFD173A471193AC390CB2FD640
MD5 SHA1 SHA512 TLSH