Overview

overview

7

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

7

2026-08-08...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_9023a502c12bb84495acdc82a88e20da_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 1.7MB
  • Sample260808-dnh15ayfnf
  • SHA256 dc73415fdda59f64ce44427628348a6e56afa4edd8ce6778b4e945d225149353
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 41 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_9023a502c12bb84495acdc82a88e20da_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_9023a502c12bb84495acdc82a88e20da_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_9023a502c12bb84495acdc82a88e20da_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_9023a502c12bb84495acdc82a88e20da_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 468
        3⤵
        • Program crash
        PID:1872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 512
        3⤵
        • Program crash
        PID:3400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 520
      2⤵
      • Program crash
      PID:1608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 520
      2⤵
      • Program crash
      PID:1528
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3888 -ip 3888
    1⤵
      PID:3476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3888 -ip 3888
      1⤵
        PID:2400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1696 -ip 1696
        1⤵
          PID:5252
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1696 -ip 1696
          1⤵
            PID:3180

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX18B0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX18B0.tmp
                • Size 2.3MB
                • SHA256 d1dcd2dcd88cce876064142e418b3475e2fad3fdafc2141fa34375fbcac9f65e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX5359.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX5359.tmp
                • Size 6.3MB
                • SHA256 c6ebde7a7da456ee4c45ce849b1f3bac94f6ca17f561786efd54fab8232c5832
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX536A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX536A.tmp
                • Size 6.3MB
                • SHA256 95fd83cd4464504b51a09fa153931552b5857eda04a509af74f89ee6d1fe7346
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1728.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1728.tmp
                • Size 503KB
                • SHA256 9ea3c32923668066fc2e723f4ee94ec600513e9ce6a2a9df91d26efb2f0904be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc173A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc173A.tmp
                • Size 774KB
                • SHA256 1e2c959ee461ac5d1324c8ea3a7258e6d016f9654ac43d7a32c2334dceb629ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc174D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc174D.tmp
                • Size 1.2MB
                • SHA256 af53083037aca580bc1661be1c63ba5ac86d4d7d8bb870e0874eaf1000758ea2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1760.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1760.tmp
                • Size 917KB
                • SHA256 8b407cde2889e406bd33bb69017d208a70ec8d2a707716a26d2a5b512d1f9200
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1772.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1772.tmp
                • Size 239KB
                • SHA256 b6e21efd8973a6f208afa8f5d1688b6271f1257052dca97c9824097497a94216
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc25E0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc25E0.tmp
                • Size 507KB
                • SHA256 706fb01668ae2fa361f81c46f45c97467475c5fa58808983046513ecbd7b9072
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc25F2.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc25F2.tmp
                • Size 273KB
                • SHA256 7609bc44bced1e11c193e069498c96727227ef96337c35e8660b574e823bdf9d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2615.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2615.tmp
                • Size 4.3MB
                • SHA256 99bdd937a2641d40e4ff824f4313e713ede6a782cbd7cebd81d77938273426bd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2637.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2637.tmp
                • Size 584KB
                • SHA256 3a15d9fb0e350bb24069795036843d6a03dfc575f408b931b78901182bd3f926
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc28BB.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc28BB.tmp
                • Size 23.7MB
                • SHA256 b7b6f6f9d1f154ab0092e3e2651251650991a0adc033468d209745e39bc28b35
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc38AC.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc38AC.tmp
                • Size 1.7MB
                • SHA256 9ee0b6b86769e9f16d7c42e951def4da5d91ef5a69be076744f78c58f193d27e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4835.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4835.tmp
                • Size 805KB
                • SHA256 99f638b071c73fc9af0dcc210a743b92c2f97cbe5109dbee418c48338d706c97
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4858.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4858.tmp
                • Size 482KB
                • SHA256 e07444a9add2a4ffddbb75aaecbc1c5576316b164fdb954d47ebe50949d73fb9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc50A8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc50A8.tmp
                • Size 1.7MB
                • SHA256 0243b9b5a04fb1192690c3f452734e3073906e647bebb7195033d6293e120f91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc50CA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc50CA.tmp
                • Size 1.6MB
                • SHA256 39e692c5c38434ab625630342dcbac20a1dc41fa57b700142ce70597f4c6d307
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc50EC.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc50EC.tmp
                • Size 1.6MB
                • SHA256 eb16cfe61d1c1e951cece8f08c11f742b0809426c735de80aaf14d6b78aafe06
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc50FF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc50FF.tmp
                • Size 321KB
                • SHA256 b38ae13c314d2abb4f6ab3ed3a9c2a5946b3133ea7ff4e8d65cfa1c5682b9cb8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5134.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5134.tmp
                • Size 281KB
                • SHA256 67a9f8f8bf048c4628532f4f35b072298d2341ded528cbb01cee13a614c88880
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5194.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5194.tmp
                • Size 289KB
                • SHA256 338f4721ebf7c4638f0a37ff69cd8605159a5a8b380e4be1387db1c8f647858f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc51B7.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc51B7.tmp
                • Size 285KB
                • SHA256 31bdaee5e888085c92c7c97fc79924c6cdb89bf9da872931b2b443145ec4e875
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5259.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5259.tmp
                • Size 1.6MB
                • SHA256 b0fb10a456cc99c1d6f7b2869811d766e1140ae051d9110dca937dfc2d2b377d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc529D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc529D.tmp
                • Size 3.7MB
                • SHA256 d6c7c4119252784ef473d207fb716e302c558e9d1a1b1428862607e294891655
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc52C0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc52C0.tmp
                • Size 2.5MB
                • SHA256 c7e2b174963fec05450798a86d53ff57cc2d83e2b77437fd3654930435d11588
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc52E2.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc52E2.tmp
                • Size 1.9MB
                • SHA256 bf26a274b4dd9fa66bb600cc49255d5ef88596fdda2fe70aec767ef1d1a9226c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5304.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5304.tmp
                • Size 2.1MB
                • SHA256 b012b74fa992cf539e13aec5985b8299a8ca3ba2f18b5dd1d484209299aeed7f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1696-285-0x0000000000400000-0x00000000005B2000-memory.dmp
                Download

                memory/3888-88-0x0000000000400000-0x00000000005B2000-memory.dmp
                Download

                memory/3888-275-0x0000000000400000-0x00000000005B2000-memory.dmp
                Download