99400a17e7ab992da5b419fbe5c47b863f87296c4e086d2c9e3c9b680ee8d92a

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Size 1.9MB
Sample260803-aam65sthld
SHA256 99400a17e7ab992da5b419fbe5c47b863f87296c4e086d2c9e3c9b680ee8d92a
MD5 9563043ea1e6397a5fbe1a0b98c2a395
SHA1 a8252a80b254534884b721090bb0314a0f25ed20
SHA512 af8bb445950739a88f7c6b238b5cb64d7aeb332aeae0372528438630aa42877ac4ff2e864f9490534c8467a591367fac9b76099f58df56e6d3df0f0cc28fecec
SSDEEP 24576:f2JymgH/cPBGe8GbF5LSobvaDQbcm0BssACewF6Fb+:ukjfcPBJ8GbDLSobiDMcdGsbJl
TLSH
T17195C3377297D0E4C42D9074CF161AF1A5A17C68CBE597DB02C8FE25BB326D07AB9209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
460	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
4248	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
3344	SOS.exe
6084	SOS.exe
5940	SOS.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\SOS = "C:\\Windows\\SOS.exe"	SOS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOS = "C:\\Windows\\SOS.exe"	SOS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\SOS = "C:\\Windows\\SOS.exe"	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOS = "C:\\Windows\\SOS.exe"	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SOS.exe	SOS.exe
File created	C:\Windows\SOS.sys	SOS.exe
File opened for modification	C:\Windows\SOS.sys	SOS.exe
File created	C:\Windows\SOS.exe	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOS.sys

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1"	SOS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0"	SOS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2	SOS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2696	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
2696	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
6084	SOS.exe
6084	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe
3344	SOS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 460	2696	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	88
PID 2696 wrote to memory of 4248	2696	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	91
PID 4248 wrote to memory of 3344	4248	2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm	92
PID 6084 wrote to memory of 5940	6084	SOS.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
  C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SOS.exe
    C:\Windows\SOS.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3344

C:\Windows\SOS.exe
C:\Windows\SOS.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\SOS.sys
  C:\Windows\SOS.sys /zhj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 885KB
SHA256 883d9ffb43a3e5491429e842b540ca14e7b8354ff4da0bc0b2adf37f3b534bb2
MD5 dc734543c5ee80a7b49904725f600802
SHA1 ec571f032f53f1e161a86f8992e30fc69bb3d211
SHA512 9139a23639c77267a48608fd9b2dc7051c7daf18b88c8ae5f13c0bd0e96cc6d7f76df15f51e78b804a46596a9bfd1ba09d58322c044a78b05e7125118ce7688e
SSDEEP 12288:f2JylBKTUH/cwxXZNYVLeyUji0h90ZD0wxpGZIVuKrHsu:f2JymgH/cy0Le5ji0hmxNrMu
TLSH
T1B9154C26F6B48372D073C079C9D2A2BAF93135511B3485CB52C5C76C2F376E68A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Size 336KB
SHA256 a6cdf7bcf65902d735ea2fdc7aca4af442b21d4466cf97437b92552c7f383b77
MD5 0227f385073faea08192e6b65105dcff
SHA1 f73844ccd288bbb02c126e3bad43f63e2c18f358
SHA512 8f0e8ce589d11d4ce50faa7f5944218e7b6a0ea34fbb916ad185a79f92fef17f394670b2ab07d64f34f810da6fc710d932c0cc3ec1db364d7f661b5bb4346aad
SSDEEP 3072:uAs9EjdgAnEFJjJgbhDzjJkSnGH6aqjjYos+HozLr83qHq/cB9FtQTkJsHahoSX2:SajdMJyFRe6a+HqTGXHaeaEeOcJH2pX
TLSH
T171744B6AF2E29477D07306788D6692B178397A301F39918F66D4CF0D5B352E0AA3D783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_9563043ea1e6397a5fbe1a0b98c2a395_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
Size 1.5MB
SHA256 c7b2f1018e7983588887e8a98533717f0e19143c6d425a9ed3ce791723bc0cda
MD5 1a7bc4cb44eddd3f68cc5fbd0fe3def6
SHA1 43079f6b36b9f064baaf4977d8d9e67f2abe22a4
SHA512 66883f45690b60945d83a6332c8b6c49a3c04f70f79e7abc7ae19aeeed6f4bbaa9901a748b4953268b5c7a5f3b0bb829f2b5733ec7f420ae85e23f69b35d08e8
SSDEEP 24576:KBGe8GbF5LSobvaDQbcm0BssACewF6Fb:KBJ8GbDLSobiDMcdGsbJ
TLSH
T1E475A1377297D0E4C41D90B4CF160BF595A17CA9C7E59BDB01C8BE24BB326D03ABA609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2696-1-0x000000000042F000-0x0000000000430000-memory.dmp

Download

memory/2696-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2696-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-83-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-103-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-15-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-75-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-77-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-79-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-81-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-99-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-85-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-87-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-97-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-91-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-95-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4248-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4248-17-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5940-38-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6084-37-0x0000000000400000-0x000000000043E000-memory.dmp

Download