Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 14:36
General
- Target 2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
- Size 4.3MB
- Sample260727-rywlvsbe87
- SHA256 0f1263dbc5b0c5cc5f0837a9e7a69f79cd424df551e19e52502a9986741bdd18
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_6972b27ea250a083903ae03b6c61eb80_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 4806⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 5086⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 5205⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 5245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 4884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 4884⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 4203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 4203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 5122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 5122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6080 -ip 60801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6080 -ip 60801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1224 -ip 12241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1224 -ip 12241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4888 -ip 48881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4888 -ip 48881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4448 -ip 44481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4448 -ip 44481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5164 -ip 51641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5164 -ip 51641⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RCX4AEA.tmp
RCX4AFA.tmp
pUc4879.tmp
pUc48BA.tmp
pUc48DD.tmp
pUc48EF.tmp
pUc4911.tmp
pUc4924.tmp
pUc4946.tmp
pUc498B.tmp
pUc4BB0.tmp
pUc4BC3.tmp
pUc4C17.tmp
pUc4C97.tmp
pUc4CC9.tmp
pUc4ED2.tmp
pUc4F55.tmp
pUc4FA6.tmp
pUc4FE8.tmp
pUc500A.tmp
pUc502C.tmp
pUc5CAD.tmp
pUc60B7.tmp
pUc60F8.tmp
pUc613D.tmp
pUc674E.tmp
pUc6771.tmp
pUc707C.tmp
pUc70CD.tmp
memory/1224-314-0x0000000000400000-0x000000000085B000-memory.dmp
memory/4448-420-0x0000000000400000-0x000000000085B000-memory.dmp
memory/4888-368-0x0000000000400000-0x000000000085B000-memory.dmp
memory/5164-423-0x0000000000400000-0x000000000085B000-memory.dmp
memory/6080-253-0x0000000000400000-0x000000000085B000-memory.dmp