1d727d946aa35b3c5893f2b43efaa4f9dbe02e55f6d9c15eee2a6f59746398fb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 4.6MB
Sample260528-zb8a5sc18x
SHA256 1d727d946aa35b3c5893f2b43efaa4f9dbe02e55f6d9c15eee2a6f59746398fb
MD5 86590b59e7851c6bb000328e444e55a4
SHA1 aa4d87b39fc869c5a655115b81506bf763f72236
SHA512 bfb66cfda8b79a602356424f3f0ce376101c2f5588617257c11dbe62ce4cbc22363aac4e32a6c0f06f5510c83f77dee5c5e3f69955f91bd12fd767c7fd74e3bc
SSDEEP 49152:nkaynVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFktTToonbXaIU:nkayunLrHp/qKm2/Sb/gqAZjk/nbXaP9
TLSH
T198364913E78109E9F3994435CE148120D72AFD6957FB12B2309872C8EFB73967F25A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with MEW 16 IoCs

resource	yara_rule
behavioral2/memory/3248-2-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/files/0x002000000002b3d0-9.dat	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1004-16-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1036-18-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1036-17-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1004-12-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1004-20-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1004-19-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/2556-26-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/2556-44-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/2004-43-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/2004-45-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/2004-42-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/3248-71-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1036-85-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW
behavioral2/memory/1036-86-0x0000000000400000-0x00000000007BF000-memory.dmp	INDICATOR_EXE_Packed_MEW

Executes dropped EXE 5 IoCs

pid	Process
4776	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.tmp
1004	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
1036	GOG.exe
2556	GOG.exe
2004	GOG.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe"	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe"	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe"	GOG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe"	GOG.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\GOG.exe	GOG.exe
File created	C:\Windows\GOG.sys	GOG.exe
File opened for modification	C:\Windows\GOG.sys	GOG.exe
File created	C:\Windows\GOG.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
File opened for modification	C:\Windows\GOG.exe	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOG.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2	GOG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1"	GOG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0"	GOG.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3248	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
3248	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
2556	GOG.exe
2556	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe
1036	GOG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1004	3248	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe	81
PID 1004 wrote to memory of 1036	1004	2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm	82
PID 2556 wrote to memory of 2004	2556	GOG.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.tmp
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
  C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\GOG.exe
    C:\Windows\GOG.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1036

C:\Windows\GOG.exe
C:\Windows\GOG.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\GOG.sys
  C:\Windows\GOG.sys /zhj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.mm
Size 3.7MB
SHA256 97ef7bacc6ab6c9ad9df5cfa993456f0b903bc9fc5bff91ac110849a62781d40
MD5 644f7bada09db960c098cb99ed0614f6
SHA1 8ff7499fd2864eaa88531906acf4dd6093e1bb21
SHA512 c995ae9bd70165513ed32d0107679a796000a43162e415c41940025ebe22b52710164d2e3580832295de02a6032af006644ea9c3a53040b786e3682e1ff321bb
SSDEEP 49152:nkaynVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFN:nkayunLrHp/qKm2/Sb/gqAZjN
TLSH
T14C062713E78149EAF3890536DE148150D72AF92D97FB1231346C12C8EF97387BF65A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_86590b59e7851c6bb000328e444e55a4_cobalt-strike_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_njrat_vidar.tmp
Size 996KB
SHA256 0ff1cbb1212fc12240a17455eb525fc152724134f760efd848ef86b8a03e85e0
MD5 4b9433103a5315a2ffc060a4beee9aa2
SHA1 2b19ab27a925bcafb595e746effa2e5231241f68
SHA512 99296c47919f77c21d8663ff2bac1d0ce7ab386b458568a0dc9cadaecababcb049b29ed64a2d8adcd910c0480f270d67fd599f4b38927b434f5065450e5d3c1b
SSDEEP 12288:BZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rovX:atTuRWFsronbEqa6+GG8yKrO4cv
TLSH
T19A258D1BB79400E8D42AC175CB554236EA72BC560B30AADF06D0B3692F77AF46F3A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-20-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1004-12-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1004-16-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1004-19-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1036-17-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1036-18-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1036-85-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1036-86-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/2004-43-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/2004-45-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/2004-42-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/2556-26-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/2556-44-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/3248-2-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/3248-3-0x000000000042F000-0x0000000000430000-memory.dmp

Download

memory/3248-71-0x0000000000400000-0x00000000007BF000-memory.dmp

Download