Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 19:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
- Size 5.4MB
- Sample260503-yllpfsbx2r
- SHA256 91a027a547609f5f6722b1cc49bf960ef3aff3e65709af449cafcfb3eb6ffb59
- MD5 5b762f85f2ee23908fcf3ec16d5afe58
- SHA1 b0b3aa4f192872149b42875b4d835d7181d48442
- SHA512 041a9639a84450672c2ae0feedcce42e7376d26a8d72bd754c27a02389a78361f91bf2d9298a95a25848dce0e8f744cd534e5ff72c1f87c88891d53a0c8b107d
- SSDEEP 49152:nk31ynVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFP5cmHVdP+o/:nk31yunLrHp/qKm2/Sb/gqAZjf1/
- TLSH T169462823F69205D5F2894035DF058220D795FC698BFB53A6705832C9EFB36C27F25A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with MEW 15 IoCs
resource yara_rule behavioral2/memory/4676-3-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/files/0x001900000002b48c-9.dat INDICATOR_EXE_Packed_MEW behavioral2/memory/6120-15-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/4780-18-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/6120-19-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/6120-17-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/4780-16-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/6120-21-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/2028-25-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/2028-37-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/3296-38-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/3296-36-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/4676-84-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/4780-85-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/memory/4780-86-0x0000000000400000-0x00000000007BF000-memory.dmp INDICATOR_EXE_Packed_MEW - Executes dropped EXE 5 IoCs
pid Process 5148 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.tmp 6120 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm 4780 GOG.exe 2028 GOG.exe 3296 GOG.sys - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened (read-only) \??\A: 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\GOG.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm File opened for modification C:\Windows\GOG.exe 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.sys GOG.exe File opened for modification C:\Windows\GOG.sys GOG.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.sys - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe 4676 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 2028 GOG.exe 2028 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe 4780 GOG.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4676 wrote to memory of 5148 4676 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe 79 PID 4676 wrote to memory of 6120 4676 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe 83 PID 6120 wrote to memory of 4780 6120 2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm 84 PID 2028 wrote to memory of 3296 2028 GOG.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.tmpC:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.tmp2⤵
- Executes dropped EXE
PID:5148
-
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mmC:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
-
C:\Windows\GOG.exeC:\Windows\GOG.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\GOG.sysC:\Windows\GOG.sys /zhj2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.mm
- Size 3.7MB
- SHA256 387683a1419470e936c54497e9774a3ecf3d97328d670604790b376e58b40750
- MD5 f634b354938cdd6ceee2cde56f9812db
- SHA1 ed43d86c20ace17b41e0b97b6b74bc46e78bf8d9
- SHA512 c8b47ade59928caa6304432046dbf9c3e2f7248a4d1aca3347c41112836d6fe40a3f06f0e664d3e946d41d4e64975e8131b97ac68e3d910da13d61f5a769bfc6
- SSDEEP 49152:nk31ynVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFN:nk31yunLrHp/qKm2/Sb/gqAZjN
- TLSH T180062713E78149EAF3890536DE148150D72AF92D97FB1231346C12C8EF97387BF65A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_5b762f85f2ee23908fcf3ec16d5afe58_darkgate_elex_gcleaner_glassworm_icedid_njrat.tmp
- Size 1.7MB
- SHA256 91a455c14d79e612df344ab0ea791745a84273a5cb8ab41acc0c152b18064001
- MD5 64ac188a5951addfe8213cc0ff8e69a1
- SHA1 081172126102c221e26bbdad85226bf38ebd0b86
- SHA512 085ba1c0cf143382814c7399e25d53a5765c4fcb6e79b1d944fad9c28f362f517a13d8f669b177e7d8840dda30c7b33c9785e402b287a468641e75cb3723d77f
- SSDEEP 24576:sDv+TJ5j6JINHVnVA//focYPbao6MdNEdVsLkJzWNaDe:R5cmHVdP+ovcQLkxi
- TLSH T1A4850633B2F200A9C45DD0769F46972296D17C758FE0E3DB8241725A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH