264a9a5b28a44466bfa04da95032fdda52bf7e60cab49a19f15e149e6d25548a

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Size 638KB
Sample260727-g3f2vsaj5v
SHA256 264a9a5b28a44466bfa04da95032fdda52bf7e60cab49a19f15e149e6d25548a
MD5 b44163e2c40ad5c9a46023e4102d7ab3
SHA1 6e78fa320da66156b7495c127147d7c96148a294
SHA512 bf3a2fc9bc52ad00602c1c0d33fa0f5f5575612650614714745daa63f7a15996a5fd8314794a68876cb0ad8c275c78eee101cc9c723101438122ed150faf3a87
SSDEEP 12288:pW4m8nt/+D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftJ4:c4mWkJVJTt4D7/SAOZi+5v48cKf/4
TLSH
T193D47C15B3A084B6D0779238CDA78625ED76BC558B30D24F23B8779E0E337615D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1136	2508	WerFault.exe	89
5036	2508	WerFault.exe	89
2748	4624	WerFault.exe	87
2920	4624	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4624	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4624	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
2508	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
2508	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2508	4624	2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-27_b44163e2c40ad5c9a46023e4102d7ab3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 428
    3⤵
    - Program crash
    PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 504
    3⤵
    - Program crash
    PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 524
  2⤵
  - Program crash
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 524
  2⤵
  - Program crash
  PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2508 -ip 2508
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2508 -ip 2508
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4624 -ip 4624
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4624 -ip 4624
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXA38B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXA38B.tmp
Size 2.3MB
SHA256 1285a2987357c1f6a4dacac384a35c00744139fd6591df19d28da3d0ff315349
MD5 f3f11397f3de7db8b34f38e8ac80dac0
SHA1 f3fd7908ce4661e3044d61393ff2c4cea2293122
SHA512 de3f964bfecf6e37b1285d88dc638ec65c9e26a39f76664b5c063fda71b5b5bba47430231560031bc9da33424784f90527389bc8b6896e6c3f89b0019df35035
SSDEEP 24576:I4mWlCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc34494:rmSCbRquA/m2yL5zbfFiV+XenmE3/zN
TLSH
T187B55B0976A8C1B4D1E6C7788AA3C647F3717C154B3097EF5265670E2E33BE58A3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc790E.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc790E.tmp
Size 1.8MB
SHA256 60c996bff95e1b6ac5dad34de85ee6112c775f8be1f3aa4d81a79d9619060052
MD5 f788004b093d6fb48adb36863ffc2d6d
SHA1 a2c9e55954b6d891b4024d8fad03b2fb23a5b264
SHA512 70a9da9fda9a95aeb0dfea41831729906490bcabe0ca0eb761decd667ffda171d0c169dc0165f1120feac922f92263afcc7e92f1160c4dce4bbc58db429d6ca4
SSDEEP 12288:0W4m8ntIN5246ikzRwmON7ZGXnueIKaxdyyvnsgx2sYfFbuoLMz4:L4mWKs47WXnueVulvspdb7LMz4
TLSH
T1EC8506E27EA0F075D0D148753E0BA6BDD963BC709E1382C733E3F32E59762915A26126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc8631.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc8631.tmp
Size 2.5MB
SHA256 07c1097919a524b16ac8e00083b0a117c2a2eb52eebfe1f32b9449f86046548a
MD5 918f37aa153012e58506ee5b8771881b
SHA1 f1d5a51ce58e9bbb999b9cad14707b5c9721b206
SHA512 aa6e3ab68514b795ee5b548e75f33ca5895a64dc488089dbf8fbf0152dac1b9da36700b108fc4503124d037d1759cbfa3a96e7b74525f598c3983bdfb064871c
SSDEEP 49152:fmgt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBHGDDxBZm:QnAjUt2jc8tzhYhMMFW8LMprGI
TLSH
T172C5AE21BB81C032D1B311318ABEA779597DBD312B2281DB73D4379D1E705C2BA3AA57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc8663.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc8663.tmp
Size 638KB
SHA256 4a50da08b8ecad551aa1e605e25cfd456e634d4a27e7a32e2d0a175157054906
MD5 2a644b217f741c95ebf9cd323cf51327
SHA1 f323f3f65a2c5a93deb15c0675ca4d11e35efbc1
SHA512 d8e07feedf51204bfb38c13c7e481aea762ce939f2979782a18e0f48223c1c3de76998d7d2f9511cebb7e334d82cc6187109c83d1cf36b32671da2d9880230ab
SSDEEP 12288:pW4m8nt/+D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftC4:c4mWkJVJTt4D7/SAOZi+5v48cKfQ4
TLSH
T1F9D47C15B3A084B6D0779238CDA78625ED76BC558B30D24F23B8779E0E337615D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc94CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc94CD.tmp
Size 757KB
SHA256 530d5d680701faf878612141e38ac5d7ead5fa0fafb72965836b4a96c39aec56
MD5 95b66bb265259e74206d484d663e812b
SHA1 ac9bc28f11578172d6021ebb39872acb69babde2
SHA512 86629b9344bec32996edc9a9bb590825ad905e345d3a0ae8bf24569af99b7552a02afab933a4d0658c2ca0c761b4a13ffa48847b0b2605dfe740f2650f213aa2
SSDEEP 12288:LW4m8ntBnXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJ4:64mWr0Le5ji0hmxNrMJ4
TLSH
T18CF42925F5A48331D073C0B9C9D3A69AED313C815B308ACB53A5B76C6E776E68636331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc97B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc97B2.tmp
Size 900KB
SHA256 0af2a3b864294b8df39920bf271c745e1651631ce03e0c8f3b4a1fc4367224d9
MD5 c12aa0b63bb2a0b3461a2cd7de1584f8
SHA1 165de95999d64f700a1ce6420829cdb2469a40d8
SHA512 c8a3f058782da0d287bc9b3fe2017cd143ec3f9c08746e51e6880fad2d9498a7984ed5733cbd15fcb1be0c3e4993dec71046ad16d65a917f771c0a2eed1d1a27
SSDEEP 12288:aW4m8ntZFVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98a4:F4mWrVbqPb88hv/l+7a4
TLSH
T15D152966F5A4C231D072C0B9C8D3A69AEE323C415B318ACB1395B76C2E776D6D636331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc97C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc97C5.tmp
Size 222KB
SHA256 2fcf65a7abe6e0cca0c388ac58e6c47a9d2eb6936b08465f5efadaf140adae1c
MD5 40b82a251b20a09d0f35edad697889f6
SHA1 163b6d1f765e7cc2419aca650865ffb8ea953df5
SHA512 7321619516c613ca6be328bc0afe41d25cebfef9fb42aa1482e00d4fed1a48d1c0bc16530ecd42ef39418437c3aa16be39ad655f3494d53736cd49e33c6a53a7
SSDEEP 6144:1FQ4afbQz3TOe6my2PcOq6KpCHNNkba7X4:1W4m8ntWbaX4
TLSH
T18D246C25B1C0C477E1920AB01DAFE67A9C39FE909E25452BB3F43F8E9D743916906293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc9AB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc9AB6.tmp
Size 351KB
SHA256 ae32abcab5cf7624e4e098c4cab6668c90d8a8df7313f3086a18eab97cd58b9c
MD5 997d8d20b65a5e0e715f0dcf702871b7
SHA1 fdb19946e91acc299212d3cdcf37ccf39cf8ee16
SHA512 9a01e43086e74def987b3627a9d057963cc8647b130dfe930fc5d588f5c3534d8587c607df556e0180043775f558a2d58f73c985e766ef4e586434bd400364b3
SSDEEP 6144:xFQ4afbQz3TOe6my2PcOq6KpCHNNyU3psmeI+sQFqT3QA4:xW4m8ntYDXsf3H4
TLSH
T1B674E315F28080B6C05E0574CFAB9625BE37BD918AE1828B63F0FB7E5F752906DD6243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcA3AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcA3AB.tmp
Size 489KB
SHA256 c2bd2da00af9056156c2779721a65b4be6be6731cc5291360f7d9dbcf09d9789
MD5 a471856607b0d09d3a5d12b46ecf0917
SHA1 d8b992ba37d0d32e1dcee66006e3066d6d54e474
SHA512 3c3761b5ba230b8037b4ee5154782e6383d72fbb10aebd94c85f507a593fa4391dcda32343ac215d0fa9ec7fe79f143f556f0090a9f233b83a7d9a88ca33abbc
SSDEEP 6144:lFQ4afbQz3TOe6my2PcOq6KpCHNNNbOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91BW:lW4m8ntf+eBNUbTVO86UH4
TLSH
T16DB41827BE64ECF2C17A49B45E93C6009B76BC604F1193CBE2B4B34E9E336D11D26916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcA3BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcA3BE.tmp
Size 255KB
SHA256 be273a037987884073fca22debc5379039998fc23af9f395ad17f83058a179fd
MD5 fda8a46e0fc55e359a81b55035c2bd28
SHA1 d444b7a776baec74418f28ad475badae7c6ac353
SHA512 f5dc93fb7301094fd280db527e3f7dfac17e7fc7abea8e3a7462bfe8de6e7c24e0e485f8b91f29568715060a08872cc85a7f5f2075831170c31263ec574ee16c
SSDEEP 6144:4FQ4afbQz3TOe6my2PcOq6KpCHNNl4cr0Xs4:4W4m8ntn424
TLSH
T1B3445B21B2D0C437E0A20AB05DBBD67A5C39FFD1AE21811B77F47B8E9D723916902257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcA78C.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcA78C.tmp
Size 567KB
SHA256 72d46cd0932ab8e97c0d2db3782699b9e211094eec1e09e21000ad47632f3a23
MD5 fe6d57e4d81804bf0e6d06b2ce89d4a6
SHA1 d6698435da69aa2a5f8801b32de9bcb5a9324f27
SHA512 e6dd89f522d68ed99b016e7f1edf71c0617b497c79ecc24179812b110bf1b0b1f2f1adc82c7fca673d729b1a0dd3fae66b575acfe4acec9a89c2057dcc731994
SSDEEP 12288:5W4m8nt7FAwSfxL/2Dc3jDLLmt0LDQewsAjRH4:M4mWqaewsAjZ4
TLSH
T113C44921FAA0D436C27B09B11E6BD72A5C39BE604F5109C7F3F87B8E5D702D22636616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2508-66-0x0000000000400000-0x00000000004AA000-memory.dmp

Download

memory/4624-58-0x0000000000400000-0x00000000004AA000-memory.dmp

Download

memory/4624-117-0x0000000000400000-0x00000000004AA000-memory.dmp

Download