Overview

overview

7

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

7

2026-08-04...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 17:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_ea1f26984fc9fb2959160ba056aa3272_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_stealc_vidar.exe
  • Size 2.7MB
  • Sample260804-v8nksaed84
  • SHA256 cf169aca60f1532f88f74efb1a07e10f7de9ac4405fd49731301d97534775d82
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 42 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_ea1f26984fc9fb2959160ba056aa3272_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_ea1f26984fc9fb2959160ba056aa3272_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_stealc_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_ea1f26984fc9fb2959160ba056aa3272_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-04_ea1f26984fc9fb2959160ba056aa3272_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_stealc_vidar.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 460
        3⤵
        • Program crash
        PID:2784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 504
        3⤵
        • Program crash
        PID:4980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 524
      2⤵
      • Program crash
      PID:3752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 524
      2⤵
      • Program crash
      PID:896
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1340 -ip 1340
    1⤵
      PID:5352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1340 -ip 1340
      1⤵
        PID:4492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4644 -ip 4644
        1⤵
          PID:3088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4644 -ip 4644
          1⤵
            PID:5916

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX594.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX594.tmp
                • Size 6.3MB
                • SHA256 444e7b26d1847c2cf8e389312a9b6b836c344657e602a10ecb7bc0bcf726c9a6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX5A5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX5A5.tmp
                • Size 6.3MB
                • SHA256 df470404242a8ee3b9d2a6aca02e2f8d8e44b71e85f4583fd1ec8a95dceba93e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCXD8E8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCXD8E8.tmp
                • Size 502KB
                • SHA256 3e9e0a0bd0074a51936c1f3653952cf92238bac70d1424dc8c7957168514a252
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCXEF21.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCXEF21.tmp
                • Size 2.7MB
                • SHA256 7e54561506d5ae2fc9b9ec6f6c0bb4a9bb291acde02469780f9a3ec73f71e5ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc246.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc246.tmp
                • Size 2.7MB
                • SHA256 6e97406608727c0470dbd114d5dc8918355502f87b1b4688496b4e8f446eae3d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc268.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc268.tmp
                • Size 2.7MB
                • SHA256 7935f9a9fedac52fb2dd99f02b8dd16e2e3e6c3f6d0ad1add81f0783c0dd196b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc29A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc29A.tmp
                • Size 2.7MB
                • SHA256 637f5e3e18e179ce008a017a4a4e46a1309236b3bef48cc6a48390003b45d3cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2BD.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2BD.tmp
                • Size 317KB
                • SHA256 41f751ba4c4628d3cb69b2631f0856ec9bfaeefa06fc7e9d4dccfb9e7c2bcea7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc301.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc301.tmp
                • Size 277KB
                • SHA256 d2576a97a9aac98b536fcbf675328de7fbbef039febb9f7fb0c911aa8b5268ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc362.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc362.tmp
                • Size 285KB
                • SHA256 e068d29779cb1a290aafd7e1a6555a4ac46369da398b50e68312e820689552fb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3A3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3A3.tmp
                • Size 281KB
                • SHA256 ad29473ea2db92acc879f764c2140ab5d0a314051c9188b53402195046b81abe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc465.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc465.tmp
                • Size 1.6MB
                • SHA256 540d172884a0453dd27496a54bd17cc0b419d9d5516f90ba2bbd800e89536732
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4B9.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4B9.tmp
                • Size 3.7MB
                • SHA256 a9787589b63bbceacf21dfdd8d661ec9c67a90cb9950b1b4458bf494876b8aca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4EB.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4EB.tmp
                • Size 2.5MB
                • SHA256 b0d917210ed16f46ed29dc6876c1a70ff1dda8b1b8c03b6634ecb13198e8a2fb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc50D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc50D.tmp
                • Size 1.8MB
                • SHA256 54f76ad59b5f7b007aa6e422257ce40482e79bf9a370dbffbfbab4484464bb63
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc52F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc52F.tmp
                • Size 2.1MB
                • SHA256 2c00be7f195e2582307ee62d67e974b6964f6137e659cb5920390b04dd3d5e64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcCF13.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcCF13.tmp
                • Size 770KB
                • SHA256 163074a3522292ec511d90637ddb4c4ecea3866d6a8fbfe1f3185e18bd988a77
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcCF25.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcCF25.tmp
                • Size 1.2MB
                • SHA256 e98d9a07006b3ee1280aa5896e9a246b167d6f714b274089c5f8f889c5c24962
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcCF48.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcCF48.tmp
                • Size 913KB
                • SHA256 38cc199c5f703cefc2b8452d63a19942b9bbbdcee6462756b2886bc3a9c61c82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcD67E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcD67E.tmp
                • Size 235KB
                • SHA256 7419fc2db4bc98ee829ad5fe6dcf762ce4d59ae7d03d76452cbe174e6a576d1c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcD6A1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcD6A1.tmp
                • Size 2.3MB
                • SHA256 2caee345fafa7ea0f9b48ca71049e271e87223badf69f10d3e969c2f11f64fec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcD8E9.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcD8E9.tmp
                • Size 268KB
                • SHA256 2b2c053229219bbcbf81d2335080454f14fdfb7b69cf533f57d5ae0accc142e8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcD91B.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcD91B.tmp
                • Size 4.3MB
                • SHA256 f85f237c5936348ef5e14fa6e08533deb618b9d1985c9e2f3598b4b6b81eee01
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcD93D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcD93D.tmp
                • Size 580KB
                • SHA256 2eeadcff5aad3293b81a434b05396f29673c1e5037b3afc7fc1398369e01bb8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcDF5A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcDF5A.tmp
                • Size 23.7MB
                • SHA256 f1bec951c588dba69e7f71b41e357cba7cead7e80b55713f7475d73fc1084f00
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF7B1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF7B1.tmp
                • Size 800KB
                • SHA256 3e2c33d1c263f0b7572958158c2790ec27c423d703535a691eb60469fbae7b51
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF802.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF802.tmp
                • Size 478KB
                • SHA256 c863e53c6f85301be7f600e490ce4b32464bb324c959a35a48869195129f0703
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1340-80-0x0000000000400000-0x00000000006B8000-memory.dmp
                Download

                memory/1340-253-0x0000000000400000-0x00000000006B8000-memory.dmp
                Download

                memory/4644-284-0x0000000000400000-0x00000000006B8000-memory.dmp
                Download