Overview

overview

7

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

7

2026-08-02...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 18:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_7001cc4b4accd673bbbfb9ce3035955c_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
  • Size 408KB
  • Sample260802-wrbekadq21
  • SHA256 ea276364a77447d42c61a63e8b5ce8f21f1b285d2b01d9b96811c23efb86193e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 8 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_7001cc4b4accd673bbbfb9ce3035955c_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_7001cc4b4accd673bbbfb9ce3035955c_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 488
      2⤵
      • Program crash
      PID:5480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 508
      2⤵
      • Program crash
      PID:1724
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 936 -ip 936
    1⤵
      PID:4344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 936 -ip 936
      1⤵
        PID:4764

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RCX7111.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX7111.tmp
            • Size 738KB
            • SHA256 bd60b5606640ef1fca1d4140d7ac143cb420f5567c4e31c7518844a86789fe14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RCX86FA.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX86FA.tmp
            • Size 408KB
            • SHA256 4b9ea21229f378ebaddeaabaa7a00e8e328184e6024f6c479c526faa8ac4d00b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc7122.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc7122.tmp
            • Size 1.1MB
            • SHA256 9bc9919b20c936b0942f70eee3be93ac81f8898b12cf40ab460ee518110caf30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc7B76.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc7B76.tmp
            • Size 881KB
            • SHA256 e6947c3df04d4bd7f81bb9613d2de0c6034b5a1ed4a74b9455edc225fd49b41d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc7B88.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc7B88.tmp
            • Size 203KB
            • SHA256 8a1cae99621c81ef7a274127ae54a71e76768bfe42514236240ef845f2211038
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc86D6.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc86D6.tmp
            • Size 333KB
            • SHA256 e6f75e04ce0a51a987105c98979799c2b44d321a2e657855bdc5babe422ebe74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/936-49-0x0000000000400000-0x0000000000470000-memory.dmp
            Download