5b41c2efcbaabf323fdbade9a8247854c5e2c9a4a2f5e78d42e24c8b25fa8d20

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_1df1911480f4311872dd07dd0796f77b_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 17.0MB
Sample260925-q7dlzaee67
SHA256 5b41c2efcbaabf323fdbade9a8247854c5e2c9a4a2f5e78d42e24c8b25fa8d20
MD5 1df1911480f4311872dd07dd0796f77b
SHA1 29d405d361f45649b2ceb7f4a376c7085beb5d9e
SHA512 f4270f6177a957a7b7f4a9e5c27b60d35055fa42a08fb8115a9d1a47fb2d00db4e91e61e484aed83345d396acf308b115f42f301dfc4aeab6dfd0524a6bfd1c4
SSDEEP 393216:JK6HiRE5bx4l3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SO:AUbx4pKOxk6lFiPvQz
TLSH
T1D3072312B79258A2D8B49F7C04196303413F2E87DE98AFEF3BD6376D4AB15F08976442
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4876	dcOpHC6Lx.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_1df1911480f4311872dd07dd0796f77b_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcOpHC6Lx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4876	3480	2026-09-24_1df1911480f4311872dd07dd0796f77b_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 3480 wrote to memory of 4728	3480	2026-09-24_1df1911480f4311872dd07dd0796f77b_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-24_1df1911480f4311872dd07dd0796f77b_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_1df1911480f4311872dd07dd0796f77b_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\dcOpHC6Lx.exe
  "C:\Users\Admin\AppData\Local\Temp\dcOpHC6Lx.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dcOpHC6Lx.exe

Path C:\Users\Admin\AppData\Local\Temp\dcOpHC6Lx.exe
Size 21.0MB
SHA256 76c050fc0bbe12f7c4be52cd85b7600ff34f1e69407895e757c1690b0c4a4284
MD5 dd58f02fda5459fc5549a537072ce72a
SHA1 148551f7f0d97966d507697acc2476c6e357fb68
SHA512 6995c28671c5cd24b5b51f2c28518135d758be306d426e56a6ac241ca203875dc16b78a03d78624e89196616a41278265d1e22976466f97fab65c95a6f9e403e
SSDEEP 393216:JK6HiRE5bxM6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcvW:AUbxMPvQ6yhpKOxk6lFiW
TLSH
T168273322B79258A6DC749F3C04196303403F2E47DE98AFEF3BDA37694A715F08976942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 56d638cef6da850257c0efbdf6029e492077a3eeed63d75476a7ad1c04d2f100
MD5 5657058f60453a078802655442d7ea90
SHA1 8ff442e075e5b97da2dc22ec7b65593c6c06bf1c
SHA512 2c092ded8b33dae2490990be53627c15273da8f083de637e0dd8e8404de3d97824aa6470c42c2ebf6517cb2fe419b397c04cdb09c16ee5f8e2bdb681d4717c8e
TLSH
T1FBE0268745A985001F09606B03F76A49D828549E2A84BFD39725A22A78C240C6AF52C5
MD5 SHA1 SHA512 TLSH