34e5d4394b56a68483b6fc9930d9cc4a4107540f23bdf0d7f6abd27eb079ec2d

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_80aa03aa62943e97307e3e4e49f439a4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 17.0MB
Sample261104-s2chtsbs3s
SHA256 34e5d4394b56a68483b6fc9930d9cc4a4107540f23bdf0d7f6abd27eb079ec2d
MD5 80aa03aa62943e97307e3e4e49f439a4
SHA1 8cb12c7b3984d302e60736690a49c874ca324c5e
SHA512 20a202b7a64140748fda48d7845708699ae22757c592287f255e95c337b54106ef81ac5277865bbe673ce26f31cffdbbc0af04fd7e0c9543a5ed83947f597580
SSDEEP 393216:JK6HiRE5bx2IRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KExL4:AUbxhlFiPvQ6yhpKO4
TLSH
T1FC072322B79258A2D8749F7C04196303403F2E47DE98AFEF3BD6376D4A715F089B6852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4516	vVyZGQMG63aSw.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vVyZGQMG63aSw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vVyZGQMG63aSw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vVyZGQMG63aSw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_80aa03aa62943e97307e3e4e49f439a4_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 4516	5368	2026-11-03_80aa03aa62943e97307e3e4e49f439a4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	84
PID 5368 wrote to memory of 4572	5368	2026-11-03_80aa03aa62943e97307e3e4e49f439a4_darkgate_elex_luca-stealer_mespinoza_njrat.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-11-03_80aa03aa62943e97307e3e4e49f439a4_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_80aa03aa62943e97307e3e4e49f439a4_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\vVyZGQMG63aSw.exe
  "C:\Users\Admin\AppData\Local\Temp\vVyZGQMG63aSw.exe" /i
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 aa57f59e197b465319e1d496fa0f63ff13d6b28b1505cf5ab4ac0db160ba45bb
MD5 864c2a24c5fa1753c44fb0c6468dd9b7
SHA1 3a52aaf17bba02bd52dfc42b9da4750d918804e2
SHA512 548a2d93bae3354cb86389898d36405ece236284221a28decfb9ddcc031395135cdf41511e193e58457260d1d520a4a526efb8c778c885885a2bcfc7ce313c61
TLSH
T13DE0200F00944A85190571BB03FF1557D4144CDF5A5A7EC04314952976E25CCD6F57C9
MD5 SHA1 SHA512 TLSH

Submit Download

vVyZGQMG63aSw.exe

Path C:\Users\Admin\AppData\Local\Temp\vVyZGQMG63aSw.exe
Size 12.0MB
SHA256 d2a3ea7b760ea679bfd584479be50f94706412901034c8e2cd1611d8241f85b5
MD5 84a3dc186b2cb285e3d169fe4be40d1f
SHA1 e8ed5b881a474401382d845c66756fa77af57aa4
SHA512 0402516868beec285292ff215e57814efa1d054492a585c482730c265e9fa8503304419513172d932f238aadaa6733c73145a9cb4ed1d0c3b25d7eb66e80312a
SSDEEP 196608:JZ872k1AeAi2KOld5bxRQ8fCGnbP3JzATC4C8WfszNpiRVxK65DzLb:JK6HiRE5bxKExL3JzATzC8WfeIRVlFvb
TLSH
T1FBC62322B79258A2D874AF7C04196303413F2E47CE98AFEF3AD637AD49715F08977852
MD5 SHA1 SHA512 SSDEEP TLSH