Overview

overview

7

Static

static

3

2026-05-06...ar.exe

windows10-2004-x64

7

2026-05-06...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/05/2026, 12:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 4.4MB
  • Sample260506-pwf3aaa17v
  • SHA256 011439b6a2f97157c3c5c648c113463f3ef594ea57fbb4cd98371b0257139645
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 22 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4184
    • C:\Users\Admin\AppData\Local\Temp\2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 380
        3⤵
        • Program crash
        PID:6120
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 380
        3⤵
        • Program crash
        PID:2416
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 500
      2⤵
      • Program crash
      PID:5048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 500
      2⤵
      • Program crash
      PID:3604
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4184 -ip 4184
    1⤵
      PID:1868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4184 -ip 4184
      1⤵
        PID:648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4812 -ip 4812
        1⤵
          PID:2000
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4812 -ip 4812
          1⤵
            PID:3812

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                pUcFC32.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFC32.tmp
                • Size 862KB
                • SHA256 6d6f8d44273017bf35bdbfd6d1f2dd0222ea16daf32e6280b0e6d4a10e7e0d42
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFC74.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFC74.tmp
                • Size 4.4MB
                • SHA256 011439b6a2f97157c3c5c648c113463f3ef594ea57fbb4cd98371b0257139645
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFCA6.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFCA6.tmp
                • Size 930KB
                • SHA256 12126401f55254b762d87986a02d67a5f592cd43ea7ebdbc737054ea4dbb0af5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFCC8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFCC8.tmp
                • Size 253KB
                • SHA256 c51fb517699db8584bfc5b1871f0c2c4166f46eb4c3c23f1c9f65170063a9ab1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFCEA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFCEA.tmp
                • Size 2.4MB
                • SHA256 906439d4eb950235133758d8cb00e9399e278d6c32b8597d4e04a71f7eecd829
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFD1C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFD1C.tmp
                • Size 594KB
                • SHA256 0c30d72572ec2fc151a0b11e9eec43608d29cb5414da6a6309c605673b38c69d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFD3E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFD3E.tmp
                • Size 360KB
                • SHA256 011cceba53711d5d839c79970d9b17eeb9cd31a830852c6867adcb8e42edf00a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFDB2.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFDB2.tmp
                • Size 672KB
                • SHA256 70bf6e0cbb9fea14af8b04228a56d01158b447599db4575424d3d0ad8bb5fd69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcFE61.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcFE61.tmp
                • Size 23.8MB
                • SHA256 0ee6dc1479e7d6e3ba7075915e308f150924c429c76feedb200a986f64f1f6a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4184-211-0x0000000000400000-0x0000000000871000-memory.dmp
                Download

                memory/4812-228-0x0000000000400000-0x0000000000871000-memory.dmp
                Download