265cf9fee03b9b4fa2934879b7bcab7c40357d35c9ab1e1103f4189e8942e253

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a87a21bcec576763d112eed62c9f4176_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 10.0MB
Sample261024-bvyn2sez9v
SHA256 265cf9fee03b9b4fa2934879b7bcab7c40357d35c9ab1e1103f4189e8942e253
MD5 a87a21bcec576763d112eed62c9f4176
SHA1 77c0d751d6a5f6512a0bdf70eead6b8b1b8d51a5
SHA512 508b263d708252076627de8c9e8acbb8210ae66329169bff4acba16182742b01b25dec895059c5cc4417093f32af263e1630c334918850272b13702a4e2c1b9b
SSDEEP 196608:JZ872k1AeAi2KOld5bxR8ByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C8WZ:JK6HiRE5bxKNSG/lVrl3KExL3JzATzCp
TLSH
T1D2B62322B79258A2DC749F7C04196303403F2E47CE98ABEF3BD6376D4A725F18976852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4224	g951ukegS.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5728	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	g951ukegS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	g951ukegS.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_a87a21bcec576763d112eed62c9f4176_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g951ukegS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4224	4644	2026-10-22_a87a21bcec576763d112eed62c9f4176_darkgate_elex_luca-stealer_mespinoza_njrat.exe	89
PID 4644 wrote to memory of 5728	4644	2026-10-22_a87a21bcec576763d112eed62c9f4176_darkgate_elex_luca-stealer_mespinoza_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a87a21bcec576763d112eed62c9f4176_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a87a21bcec576763d112eed62c9f4176_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\g951ukegS.exe
  "C:\Users\Admin\AppData\Local\Temp\g951ukegS.exe" /i
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 81c173a7209012e7a825f2b536eb0d8b9ee38d742ed768bb334be36bc65db9f3
MD5 e2e82a63c6a5525b2b404a65bfe5a96a
SHA1 097aa6804b00dc08d664f63d4a77c2a803b28255
SHA512 4b7448e198a3372f85a83ee563fd83a6d9426e3e5c6a970013b5d298602f3da7490cefc1b5fb5bef5d5a68424f84d0c3acf00d5ad8c04df6ebd58bd83c1a38a4
TLSH
T189E0260F41B49950010621BB02EB2D99F92805662A05BBC85354823925CB18CA3F929D
MD5 SHA1 SHA512 TLSH

Submit Download

g951ukegS.exe

Path C:\Users\Admin\AppData\Local\Temp\g951ukegS.exe
Size 22.0MB
SHA256 07852942edca12e6db5cad4dac5a6dae037c6864bb0c0c2b1956aa5c6a01d6f0
MD5 3fe365d5f771dee1b1b0d3a9580041ab
SHA1 1efd7d34bf320a4b5d2155d00dc4ac097e16c0ac
SHA512 902dce1c0e5201a3f573170798ee7e08d6214533b5f0bbc9f63bfebb11a6f8760522df93320a0f72381f0c907fedc70b1ae90b3a164f4b7cfb9b96e923d05d23
SSDEEP 393216:JK6HiRE5bx+DMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVd:AUbx+yhpKOxk6lFiPvQ6d
TLSH
T17A373322B79158A6DC749F7C00196303403F2E47DE98AFEF3BDA37694A715F089B6942
MD5 SHA1 SHA512 SSDEEP TLSH