Overview

overview

7

Static

static

3

2026-05-01...ar.exe

windows10-2004-x64

7

2026-05-01...ar.exe

windows11-21h2-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/05/2026, 15:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-01_6826e638e12fbeb3e44a096d81ad23d2_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
  • Size 438KB
  • Sample260501-sty2vsgz7t
  • SHA256 64081b4a6474288b56f408a859e354b2264a8abbf0f2c55dd544b6f8660f5021
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 50 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-01_6826e638e12fbeb3e44a096d81ad23d2_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-01_6826e638e12fbeb3e44a096d81ad23d2_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\2026-05-01_6826e638e12fbeb3e44a096d81ad23d2_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-01_6826e638e12fbeb3e44a096d81ad23d2_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4564
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 372
        3⤵
        • Program crash
        PID:4876
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 372
        3⤵
        • Program crash
        PID:4624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 480
      2⤵
      • Program crash
      PID:3204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 480
      2⤵
      • Program crash
      PID:3396
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 5080
    1⤵
      PID:2728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4564 -ip 4564
      1⤵
        PID:4932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4564 -ip 4564
        1⤵
          PID:1196
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5080 -ip 5080
          1⤵
            PID:4476

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX28A3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX28A3.tmp
                • Size 514KB
                • SHA256 8a439c2f2763e1983518827ae84eeaf00818eb578af0218e89226df7846a1b69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX28B9.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX28B9.tmp
                • Size 459KB
                • SHA256 5f0b733b864b9241936094613f3d6d52831a518953afb5aa8d04818da998d1bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX28CC.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX28CC.tmp
                • Size 468KB
                • SHA256 6ec18a39e7f8bf6604c1821a650937a6fd84ca236874435a74bc5ab45395f63e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1BEF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1BEF.tmp
                • Size 768KB
                • SHA256 fbd64571fcd20438eedf2e438285e00e2869ff547a7fc5c5fc8bfc1ae31ac49c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1C21.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1C21.tmp
                • Size 438KB
                • SHA256 64081b4a6474288b56f408a859e354b2264a8abbf0f2c55dd544b6f8660f5021
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1C34.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1C34.tmp
                • Size 911KB
                • SHA256 b1e33aefacb777a1ec4904b3764c031fb5fa777c36e4854fd4046975778f6ee7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1C46.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1C46.tmp
                • Size 234KB
                • SHA256 2ba3e8e5150c3d6cd6c54633c0a31f606b7e3cfc4bc63ca11d0ad97c94cb3bd4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1C59.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1C59.tmp
                • Size 2.3MB
                • SHA256 31ba1100e148ea8551d97900f5ddf772d069664abd3636d551070fe084855374
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1C6C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1C6C.tmp
                • Size 501KB
                • SHA256 36443a2fe849eefe4463f1d8099cfd8a2232908dd469b563c0f881b82b6c25b4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1C7E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1C7E.tmp
                • Size 267KB
                • SHA256 0743f7f122b98da1c133fc68dbe41fe9c3e1a388119c87aefab487c351a1c0ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1CA1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1CA1.tmp
                • Size 4.4MB
                • SHA256 a52b46356df086ff937e2b00578cacd9778dc7e2e67d33b94c185af71184a1bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1CC3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1CC3.tmp
                • Size 579KB
                • SHA256 c6dcd08a86bbc6522ecfd4fa3a6e59f8f42993ab26eb27420b30b7b228b1c79a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1D33.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1D33.tmp
                • Size 23.8MB
                • SHA256 b2e2f7152abf93cff966cae83641f9f5be04b14c372c1ead7bb11d17fc706f42
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1E6E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1E6E.tmp
                • Size 805KB
                • SHA256 f599d487bde5053fd14f455ee4198f131651f2e9c11507c5e0dce3657f687c95
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1E81.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1E81.tmp
                • Size 477KB
                • SHA256 1766ea9822e6bd954e76d803e51ba801cd7c8307f0fa5c830ad4fe5abf329e6e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1E93.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1E93.tmp
                • Size 316KB
                • SHA256 5e518c46e507c40ecd6bf11407a99e427a8cb430f3cf92c00bee6c44413a289c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1EB6.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1EB6.tmp
                • Size 393KB
                • SHA256 76bb6ca48470eb308d9820df42caac11b15d191388b4c74194fbba459c9fd527
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1EC8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1EC8.tmp
                • Size 276KB
                • SHA256 d801fc95978bb9f4ce7a181d2d60d7f763a87009a25e01fd68b0dd2864874166
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1EFA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1EFA.tmp
                • Size 284KB
                • SHA256 566b1f178e734f1e07df126f23dccc62978beb29967d4bb3c4f4dfc4b4ee6c8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1F1C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1F1C.tmp
                • Size 280KB
                • SHA256 559bd473af8b4441b2e0d6a148e1944129340314e89533957ae12b670f791e08
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1FAC.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1FAC.tmp
                • Size 3.3MB
                • SHA256 367c6fa7a909e191fd5cb9a54de7d13798975ef541fd5883f23a57772acd2c1d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1FBF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1FBF.tmp
                • Size 1.6MB
                • SHA256 ba97f7869c39155e062b22e92f1cc7ed3c790a6e17be459221b2ed784b84a115
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1FE1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1FE1.tmp
                • Size 2.2MB
                • SHA256 b01994d2121d17ecf64df9b0b62ea119804ebbf0010601c6ade83ba1ecd578db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2003.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2003.tmp
                • Size 3.7MB
                • SHA256 7111c64ce8a618697a5979bfa862e8d420d8e6e430b06614b498b07a2304367d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2035.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2035.tmp
                • Size 2.5MB
                • SHA256 4394f04989f77d8aa19c4b52f443f3224891a28c9633114ca346ff07cb8007bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2057.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2057.tmp
                • Size 1.8MB
                • SHA256 631cb8676f64c3fbbf739542c56f5b0f94ede563f23dc60955de5e2e28e93ed7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2079.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2079.tmp
                • Size 2.1MB
                • SHA256 3f70ae65a12b50c954c0e805b62598b44319908f3ca211fe773269f5626a1c51
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc24A3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc24A3.tmp
                • Size 6.3MB
                • SHA256 edd9382b4719c1427344645ea9f46c2108b02a1bf0bac4d85bd41e0361832ce9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4564-534-0x0000000000A40000-0x0000000000B1F000-memory.dmp
                Download

                memory/4564-533-0x0000000000400000-0x0000000000478000-memory.dmp
                Download

                memory/5080-536-0x0000000000A00000-0x0000000000ADF000-memory.dmp
                Download

                memory/5080-535-0x0000000000400000-0x0000000000478000-memory.dmp
                Download