Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 01:02
General
- Target 2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe
- Size 18.6MB
- Sample260730-bd91rahg58
- SHA256 aca7b42c1648e7e5e232920c337b146175b454bff498ccd202ef16ba30b30c9e
Malware Config
Signatures
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
- detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs
- Executes dropped EXE 2 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Microsoft\2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Microsoft\2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-07-30_f2ebc99e4dd2d4d8b7f2dc59d30b8fd3_darkgate_elex_gcleaner_glassworm_icedid_njrat_stealc_vidar.exe
e10d152d79f56fedaf3765eae07c9b9c
memory/4496-103-0x0000000005090000-0x0000000005092000-memory.dmp
memory/4496-83-0x0000000000400000-0x00000000004DB000-memory.dmp
memory/4496-84-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4496-85-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4496-136-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-86-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4496-192-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-178-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-172-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-166-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-160-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-154-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-87-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4496-146-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-97-0x0000000005090000-0x0000000005092000-memory.dmp
memory/4496-124-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-118-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-106-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-105-0x0000000000400000-0x00000000004DB000-memory.dmp
memory/4496-91-0x0000000076330000-0x000000007677F000-memory.dmp
memory/4496-98-0x0000000005090000-0x0000000005092000-memory.dmp
memory/4664-5-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4664-1-0x00000000004A6000-0x00000000004A7000-memory.dmp
memory/4664-0-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/4664-6-0x0000000000400000-0x00000000004DB000-memory.dmp
memory/4664-3-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4664-4-0x0000000002470000-0x0000000002494000-memory.dmp
memory/4664-2-0x0000000002470000-0x0000000002494000-memory.dmp
memory/5060-19-0x0000000002410000-0x0000000002412000-memory.dmp
memory/5060-89-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-90-0x0000000076880000-0x00000000768E0000-memory.dmp
memory/5060-78-0x0000000007140000-0x0000000007144000-memory.dmp
memory/5060-77-0x0000000007000000-0x0000000007004000-memory.dmp
memory/5060-75-0x0000000006F80000-0x0000000006F84000-memory.dmp
memory/5060-52-0x0000000006470000-0x0000000006480000-memory.dmp
memory/5060-43-0x00000000060D0000-0x00000000060E0000-memory.dmp
memory/5060-41-0x0000000002410000-0x0000000002412000-memory.dmp
memory/5060-115-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-38-0x0000000076880000-0x00000000768E0000-memory.dmp
memory/5060-36-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-127-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-133-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-33-0x0000000002410000-0x0000000002412000-memory.dmp
memory/5060-20-0x0000000002410000-0x0000000002412000-memory.dmp
memory/5060-149-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-14-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-9-0x00000000022E0000-0x0000000002304000-memory.dmp
memory/5060-163-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-10-0x00000000022E0000-0x0000000002304000-memory.dmp
memory/5060-169-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-11-0x00000000022E0000-0x0000000002304000-memory.dmp
memory/5060-175-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-13-0x0000000000400000-0x00000000004DB000-memory.dmp
memory/5060-181-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-189-0x0000000076330000-0x000000007677F000-memory.dmp
memory/5060-12-0x00000000022E0000-0x0000000002304000-memory.dmp