Overview

overview

7

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

7

2026-08-03...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 03:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_408651dae7ad307cb09a3886e5cef237_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
  • Size 564KB
  • Sample260804-dhmr5aca63
  • SHA256 40d4996a782d531652a39cff479c8cbc0a167fa59c798adf7a7bae8adb13627b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 22 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_408651dae7ad307cb09a3886e5cef237_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_408651dae7ad307cb09a3886e5cef237_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_408651dae7ad307cb09a3886e5cef237_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-03_408651dae7ad307cb09a3886e5cef237_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:6132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 468
        3⤵
        • Program crash
        PID:3972
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 468
        3⤵
        • Program crash
        PID:4264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 536
      2⤵
      • Program crash
      PID:3000
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 536
      2⤵
      • Program crash
      PID:4600
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4376 -ip 4376
    1⤵
      PID:1380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4376 -ip 4376
      1⤵
        PID:4408
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6132 -ip 6132
        1⤵
          PID:6120
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6132 -ip 6132
          1⤵
            PID:5560

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                pUc8D13.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc8D13.tmp
                • Size 894KB
                • SHA256 b783839ed1aeb84539d449b278ff1c8cbfc9abea3cce5d5b5e118a0a0fa871c1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc8D26.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc8D26.tmp
                • Size 1.3MB
                • SHA256 c0468e469ed8a9a7d7a7d54dc7356072be23837cf592d467c21da80e5ac42038
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc8D39.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc8D39.tmp
                • Size 1.0MB
                • SHA256 0087628968f85ab4f0f5da660273215e7089d587033d6b9161f9ee353884c080
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9951.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9951.tmp
                • Size 359KB
                • SHA256 fd16093cd57daf97e244fe75a92985c16e6aa294fadf074c1a051a01ff4b0b1b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9974.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9974.tmp
                • Size 2.5MB
                • SHA256 75c26ffcc3df4c0f32068dda09e299a454af569639db8574fe9e11ff3ed7c4b6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9996.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9996.tmp
                • Size 627KB
                • SHA256 93616e3d006a1a3e38dd9db181c21dee183d428fe2cfdca695904a9e20fb5a32
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA7B2.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA7B2.tmp
                • Size 393KB
                • SHA256 804ccd2a61ca007045ebfd657f4a9dd84570074910a2836e124c16059442a19c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA7C5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA7C5.tmp
                • Size 4.4MB
                • SHA256 5c7a6c61a5e511bdfd6cf15b6d3fc07538d2aa531da97f02780eae0d91a64427
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcAB71.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcAB71.tmp
                • Size 704KB
                • SHA256 828ff2b32447385b6a00b1f4aa6db27c039c951b8906a40c879fd2b37ddc1c28
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcABA3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcABA3.tmp
                • Size 23.8MB
                • SHA256 2f16e352d4fc9ccf9e04a2456ce2156555a18f79eeba8420449303c914aecdbb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcB3B5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcB3B5.tmp
                • Size 564KB
                • SHA256 6d1340b4723af7f9bc66297c02cd25854da1b1c9801c43ca651d3841fa1576da
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC070.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC070.tmp
                • Size 925KB
                • SHA256 44d87e6fe028aa8aa10807dd77b3ba3069392bb168377563f8071e18f569cbdd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC082.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC082.tmp
                • Size 602KB
                • SHA256 5e369d1e4db2bbd682e566a83c422d3fd4c2577df9480e383c3be2db7d3f25e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC095.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC095.tmp
                • Size 441KB
                • SHA256 639e29c90db94b0343b97b7b986be5fac82e5b6656220ea8535bcdf4dbcaf9ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC0D9.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC0D9.tmp
                • Size 428KB
                • SHA256 37949e1d6be25745965ecc7525babc409fcade8783a7b590e838cac55d79349b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4376-101-0x0000000000400000-0x0000000000497000-memory.dmp
                Download

                memory/4376-142-0x0000000000400000-0x0000000000497000-memory.dmp
                Download

                memory/6132-152-0x0000000000400000-0x0000000000497000-memory.dmp
                Download