Overview

overview

4

Static

static

3

2026-04-26...ar.exe

windows10-2004-x64

4

2026-04-26...ar.exe

windows11-21h2-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 14:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-26_036c1b53cbc5f2d59ae7cc4af487b9f9_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 4.3MB
  • Sample260426-rmpdeags5y
  • SHA256 37572e8f00eb7b3e31ce8d25bd5cca4f60698d9564b1bb941b42d2b33115a885
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 47 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-26_036c1b53cbc5f2d59ae7cc4af487b9f9_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-26_036c1b53cbc5f2d59ae7cc4af487b9f9_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 516
      2⤵
      • Program crash
      PID:3524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 480
      2⤵
      • Program crash
      PID:2180
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4976 -ip 4976
    1⤵
      PID:1380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4976 -ip 4976
      1⤵
        PID:5576

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 4.3MB
            • SHA256 37572e8f00eb7b3e31ce8d25bd5cca4f60698d9564b1bb941b42d2b33115a885
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RCX4AC2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX4AC2.tmp
            • Size 4.3MB
            • SHA256 59c961d470a89d59d43bcd53b442d129cdf5f0b0fcc1010d731552b9d668dbbc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc1554.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc1554.tmp
            • Size 353KB
            • SHA256 9dfae5344d277fec14e9a8602ea75456503c9ceb310f36c939393d64e134bb71
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc1996.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc1996.tmp
            • Size 4.3MB
            • SHA256 57b5800cbcc0d3ac316254cec9299e1109337b8897e54148caa4a734913ae9a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc244B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc244B.tmp
            • Size 424KB
            • SHA256 f5c89a056bddc5c772546373ae8b9cb739ce14ee01193ea2bd5e830fa182ea2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc3015.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc3015.tmp
            • Size 458KB
            • SHA256 0e28e6f8a554ee388534a571d2689aff8fec38d66954c51ae61d902eb3b62b74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc3D27.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc3D27.tmp
            • Size 4.3MB
            • SHA256 69b1ee1178603e542b59f40afb5c0b64ac61433dac1fd7cd4641c16e19a1f126
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc474F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc474F.tmp
            • Size 269KB
            • SHA256 51d2f13765cce5db79c4b7c49ed556f96ea6dab826e6ed315fa29e34ff563d14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4787.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4787.tmp
            • Size 641KB
            • SHA256 3a106041e301121070de93e1cc21935f156a816e17940df841312fa479bb3b3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc47B9.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc47B9.tmp
            • Size 1.5MB
            • SHA256 6d8d5f9eb6117e984291805339152972b231d561522c229c7a4f0bf195da7f5e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4F53.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4F53.tmp
            • Size 4.3MB
            • SHA256 42b41f7fe7f9c97116806d56b11efd6dd3488069391f78c41480f2be01362df3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4976-235-0x0000000000400000-0x0000000000852000-memory.dmp
            Download

            memory/4976-469-0x0000000000400000-0x0000000000852000-memory.dmp
            Download