76b1c93ff4e5cedd10fe2973d74d1dca5de678f1cdcd2bf7326c6aa1fe9d86bc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Size 2.9MB
Sample260803-ath2javdnd
SHA256 76b1c93ff4e5cedd10fe2973d74d1dca5de678f1cdcd2bf7326c6aa1fe9d86bc
MD5 45cd90b32a9865db8bdd77059f7dee23
SHA1 73930679654daffe714c37af4b44599589c8efd2
SHA512 ec7854509b04dd74edcfeca03a5bd0aef5fecec937dac809d432ca38c15c6b8beed56307596da06858b910c22795f7d4f41a9deac820801c103d5832f059b85e
SSDEEP 49152:ukj5cwzPfJdTe3ygpa95HY0iLZegRNktSfsSCCe8pZaTUwp:ukjFJJfYLBTm8pUU+
TLSH
T160E56B13F2A640E9D02AC078C7169232F9757C450B35A9EF1790FB292E77BE46B39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4128	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
4956	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
3156	SOS.exe
1388	SOS.exe
3120	SOS.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\SOS = "C:\\Windows\\SOS.exe"	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOS = "C:\\Windows\\SOS.exe"	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\SOS = "C:\\Windows\\SOS.exe"	SOS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOS = "C:\\Windows\\SOS.exe"	SOS.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SOS.exe	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
File created	C:\Windows\SOS.exe	SOS.exe
File created	C:\Windows\SOS.sys	SOS.exe
File opened for modification	C:\Windows\SOS.sys	SOS.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOS.sys

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2	SOS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1"	SOS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0"	SOS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5988	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
5988	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
1388	SOS.exe
1388	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe
3156	SOS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 4956	5988	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	90
PID 4956 wrote to memory of 3156	4956	2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm	91
PID 1388 wrote to memory of 3120	1388	SOS.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
  C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SOS.exe
    C:\Windows\SOS.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3156

C:\Windows\SOS.exe
C:\Windows\SOS.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SOS.sys
  C:\Windows\SOS.sys /zhj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 885KB
SHA256 bf8de9c313ded44af4d676e9ed6d962260b65072b6b1b7e8aba7ca0cb72d7a55
MD5 3c55552a980ef4ecc1b86336f3f9ad90
SHA1 6ad8c7381174bdf0531075a88d15efea6c6832f3
SHA512 03f9767eb8f458c99d77edb879661ee424cd9ca1d2a8bd6e1d0ad563766a7b410142b8cd493b6dbe4d2e64fe16322d3ac1d7b986e71a5300c95ab1f7b5e22b87
SSDEEP 12288:f2JylBKTUHZcwxXZNYVLeyUji0h90ZD0wxpGZIVuKrHsu:f2JymgHZcy0Le5ji0hmxNrMu
TLSH
T1B1154C26F6B48372D073C079C9D2A2BAF93135511B3485CB53C5C76C2F276E68A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
Size 336KB
SHA256 6db092d15569e0005dd789938b050be82e2729d75e45fd3eec0c09492d53eb59
MD5 181ec950ad95efbc853f4932de40621a
SHA1 9c41745cc2aa6973e10571ae8186dc11bbc44edd
SHA512 76629133d090fbc74d7bcfd5c6572c04a0c35ceaf0d8284813bd218c5eaff38f5a2b15147eaf32a19e42a86cf1300fc1d0b684ba6202e81d6131507383d1db18
SSDEEP 3072:uAs9EjdgAnEFJjJgbhDzjJkSnGH6aqjjYos+HozLr83qHq/cB9FtQTkJsHahoSXk:SajdMJyFRe6a+HqTGXHaeaEEOcJH2pX
TLSH
T1FE744B2AF2E29477D07306788D6692B178397A301F39918F66D4CF0D5B352E1AA3D783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_45cd90b32a9865db8bdd77059f7dee23_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
Size 2.6MB
SHA256 7aed0c05e7db0a1f9f5d38302e7b8f3df3b18192af09e06bcf5f616ba3de9553
MD5 eb157504645dc48d4d8ec79aa8f1fe45
SHA1 85c51e657db9c691e1b5f2c62475d5c27ecc3681
SHA512 d1689f2b792a2e5f31266bfd96ba3cf950058a446a5bb51651350e78baaa96a9ff794407d5f793c9a106dea7b2931a02ddccb39f2bcbcdeda0d83b63c488b525
SSDEEP 49152:/zPfJdTe3ygpa95HY0iLZegRNktSfsSCCe8pZaTUw:LJJfYLBTm8pUU
TLSH
T138C55B13F29A40E8D02AD0B8C7069232F9757C454B35A9EF0794BB252E77FE46B39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-31-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-32-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-88-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-90-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-16-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-15-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-100-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-75-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-76-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-98-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-82-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-86-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-96-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3156-92-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4956-18-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4956-14-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5988-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5988-77-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5988-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5988-1-0x000000000042F000-0x0000000000430000-memory.dmp

Download