Overview

overview

7

Static

static

3

2026-07-31...ar.exe

windows10-2004-x64

7

2026-07-31...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 11:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_8e84e4948c1f8a2fe048415975072532_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 2.0MB
  • Sample260731-nl2esshe78
  • SHA256 efcc854740f4e2082afa433b8bfc4210aed07f9c71352df11b7a63c6ba23206f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 15 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_8e84e4948c1f8a2fe048415975072532_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_8e84e4948c1f8a2fe048415975072532_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 492
      2⤵
      • Program crash
      PID:1256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 492
      2⤵
      • Program crash
      PID:2672
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4692 -ip 4692
    1⤵
      PID:3560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4692 -ip 4692
      1⤵
        PID:1824

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            pUcCC10.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCC10.tmp
            • Size 999KB
            • SHA256 60fa41e070082385c1e4792b48ec20a5854e6f928de4ad30adf850a3c3e9e734
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCC33.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCC33.tmp
            • Size 1.4MB
            • SHA256 92bafb146cd5975a2ba3e181560e6a2ef4a48324cde65783bbd8ded504019f9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCC45.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCC45.tmp
            • Size 1.1MB
            • SHA256 6b23dad2a4711b18c7ee7a765c4da84e919ee72ce07c44975ff97b543314ba95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCC7A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCC7A.tmp
            • Size 2.6MB
            • SHA256 16068043755bd0d61dfe84ebde420c593a292453d8398153c7800469ccba4608
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcDBA0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcDBA0.tmp
            • Size 732KB
            • SHA256 a68df296a6cbceaefd49d874734b072913e365f2d6685e17f9f0383c48b7718d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcDBB3.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcDBB3.tmp
            • Size 498KB
            • SHA256 3d602b99a60c737b0d2696b354c5a04bccebceefc5894803b2e1a41515bb3a9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcDBE5.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcDBE5.tmp
            • Size 4.5MB
            • SHA256 eb83ccc46065184e234ff79bed96b1d4f5e6a636955668bed834923fac13f6c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcEA5F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcEA5F.tmp
            • Size 809KB
            • SHA256 bdf5787766c1275bb5b2bfbbacf41e80c2d422f686233f4292e30877501f81d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcEA91.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcEA91.tmp
            • Size 23.9MB
            • SHA256 294dcbadef3a9537ed16fcbac95e5a152b154f41ff59927ea90c8459a9a69592
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcF021.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcF021.tmp
            • Size 2.0MB
            • SHA256 33655e9ce6665785066abdabdbb7aa913193a7ccb8f8f9f9c3b78a211cc21b13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4692-64-0x0000000000400000-0x0000000000601000-memory.dmp
            Download

            memory/4692-97-0x0000000000400000-0x0000000000601000-memory.dmp
            Download