a236417966494e41107f728090684440f76f2f481014c0c26fd67d51cc27899b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_3e4c5c7bbee52387f2ced15ed026a1b0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 19.0MB
Sample261001-s6gcksfe52
SHA256 a236417966494e41107f728090684440f76f2f481014c0c26fd67d51cc27899b
MD5 3e4c5c7bbee52387f2ced15ed026a1b0
SHA1 0d9f006078f2c1c0eab1d8172e835794451c73d4
SHA512 6e75417c7adb51adfbb8b22184064ea31a6cddc7b4c022d7e25146b73bba5bea3a150e0a60eb91cb1066cb9e5da1dcf3ff3c12e646be02cc3cae13a795f5096b
SSDEEP 393216:2lFyfLPHiRE5bxW6QaAu5SVDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvl/:AUbxWPvQ6yhpKOxk6lFt
TLSH
T163173309B7929CA5C8301B7C20686313813E1D034F55AAEF5F967B5D4E78AF1CAB3636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4348	0D2ueucv.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4396	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0D2ueucv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0D2ueucv.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_3e4c5c7bbee52387f2ced15ed026a1b0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0D2ueucv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 4348	5604	2026-09-30_3e4c5c7bbee52387f2ced15ed026a1b0_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 5604 wrote to memory of 4396	5604	2026-09-30_3e4c5c7bbee52387f2ced15ed026a1b0_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-30_3e4c5c7bbee52387f2ced15ed026a1b0_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3e4c5c7bbee52387f2ced15ed026a1b0_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Users\Admin\AppData\Local\Temp\0D2ueucv.exe
  "C:\Users\Admin\AppData\Local\Temp\0D2ueucv.exe" /i
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0D2ueucv.exe

Path C:\Users\Admin\AppData\Local\Temp\0D2ueucv.exe
Size 13.0MB
SHA256 9e0c20bcd1e8d78bef35d28b8febf11ab735f79719b81f25bd946da5cd79cea1
MD5 cfc51c7a6c6ea48147c22420a342df1e
SHA1 13f07e54b1db6658b1c86d95719914ab4255429e
SHA512 9ac6247345145ea8571815342311761bdce4abd434a5b6e2733f6e531a450ca365ae4718b4fbd439f4eac49feec097980ec760e2a695913c9d251d2ed7d81b88
SSDEEP 393216:2lFyfLPHiRE5bxVQaAu5SVDMTNSG/lVrl3KExL3JzATzC8Wy:AUbxCvQ6yhpKOxk1
TLSH
T1F3D62305B792DC65C8301B7C2068A313813E1D038F55AAEF5E967B5D4E78AF1CAB3636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 0fcca7d731d04e2ba4a17a10819cdae8fc50fb0a8e00fdcdba055ea70c74e6b0
MD5 5482249bd21b5ad6bc977d0fcf8fc6cc
SHA1 87bf7c018c93dee4ae5c0b1974769bf952c1b4b4
SHA512 c86a3495e18bbc732748e8fa7a7a2dafe44ca9243bd515750f8a330d53c2aafd58f1d0bd5d2fade504b030ebde83e28dad35816fa504ba51a80d5b3ebf8a1b28
TLSH
T1EFE07D0BD5388900084A707B03FB375EE8745AA71E44FFC5EB61D21A35C360C6AF13A1
MD5 SHA1 SHA512 TLSH