928fefe7b65e893e20ba1ba5f0361d2ca76f2b9f02560e1d9f0c7ca4e66e1305

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_fdd2bc08f0348dbe3f9aae16e0cd5abf_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 13.0MB
Sample261003-2f3mkaybqa
SHA256 928fefe7b65e893e20ba1ba5f0361d2ca76f2b9f02560e1d9f0c7ca4e66e1305
MD5 fdd2bc08f0348dbe3f9aae16e0cd5abf
SHA1 3841450527731d758d1258192520391ed2243678
SHA512 551563e114966052a825c630c454bc9137c024ccf0113af420cffbe52586b77d0c06b8fc182afa803841ff70391c07af5323fd1e760da3e4d852da64a7ab0f17
SSDEEP 196608:JZ872k1AeAi2KOld5bxRqVxK65DzLlQCcHsJcQvQaT0u5SHvOYDMU:JK6HiRE5bxMVlFvlQCcv6QaAu5SVDMU
TLSH
T16AD62322B79158A2DCB49F7C0019A303403E2E87DE98AFEF2BD6376D4A715F08976553
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4672	cLSbwr3oh8.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1800	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cLSbwr3oh8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cLSbwr3oh8.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_fdd2bc08f0348dbe3f9aae16e0cd5abf_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cLSbwr3oh8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4672	4512	2026-10-03_fdd2bc08f0348dbe3f9aae16e0cd5abf_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 4512 wrote to memory of 1800	4512	2026-10-03_fdd2bc08f0348dbe3f9aae16e0cd5abf_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-03_fdd2bc08f0348dbe3f9aae16e0cd5abf_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_fdd2bc08f0348dbe3f9aae16e0cd5abf_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\cLSbwr3oh8.exe
  "C:\Users\Admin\AppData\Local\Temp\cLSbwr3oh8.exe" /i
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cLSbwr3oh8.exe

Path C:\Users\Admin\AppData\Local\Temp\cLSbwr3oh8.exe
Size 11.0MB
SHA256 5620173b09934e0980a09bd9d5d426bc16f1351330d1e5495a746737654bcd24
MD5 6c4f83a7ee2d818f479ae9d33a47c1b8
SHA1 ab82c28ddd439848b5a05525fe71af70a4471750
SHA512 8fbfa91dcc2571417e1c62cad77ffdb15e5719b0345b552b9143fca45d2bf56b6e652755c3ae1cbecd580db8ae0ccbd33eb8a829ab3b0702c85acc533bbd2006
SSDEEP 196608:JZ872k1AeAi2KOld5bxRrATC4C8WfszNpiRVxK65DzLlQCa:JK6HiRE5bx5ATzC8WfeIRVlFvlQCa
TLSH
T180C62322B79158A2DCB4AF7C04196303413E2E87DE98AFEF3AD63B6D49715F08977442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 292ab9c78857a2e793b5c68d7c016ead8e960db4c310f4de59ae8a4ce0815a9b
MD5 28570ec795f6f95f2b5ebd082f0580dc
SHA1 f5d0fd7119dfcaf31ff5389b33c0068dc7d0bdfe
SHA512 eb34d81a549176bb743f3b0065b951c2c1996cef89ec1d8c5d3573ecd9081c9059d139d3068d6089cbbd070c9bb68ca38f3e15130188e6554d79850583809ff6
TLSH
T14EE02607045B8E001205616723FF25D9DAF488D63A18FEC0B752867F79E384CA1F67A4
MD5 SHA1 SHA512 TLSH