Analysis
- max time kernel
150s - max time network
70s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 16:00
General
- Target 2026-08-08_66f1b5fc821bdb8fc9a44f16c2fc1208_cobalt-strike_darkgate_gcleaner_hijackloader_icedid_satacom_stealc_vidar.exe
- Size 16.0MB
- Sample260808-tfprpshq4w
- SHA256 132824a4694334f013db9b806f71ebf4522f0d834beda52558ac9e22ad617607
Malware Config
Signatures
- Family: DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Detects DeerStealer 14 IoCs
- Detects executables packed with Enigma 3 IoCs
- Detects executables packed with Themida 3 IoCs
- Detects executables packed with VMProtect. 3 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_66f1b5fc821bdb8fc9a44f16c2fc1208_cobalt-strike_darkgate_gcleaner_hijackloader_icedid_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_66f1b5fc821bdb8fc9a44f16c2fc1208_cobalt-strike_darkgate_gcleaner_hijackloader_icedid_satacom_stealc_vidar.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5248-0-0x00007FF6AB9F0000-0x00007FF6AC065000-memory.dmp
memory/5248-1-0x00007FF6AB9F0000-0x00007FF6AC065000-memory.dmp
memory/5248-2-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-13-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-15-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-20-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-22-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-23-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-21-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-18-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-16-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-19-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-17-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-14-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-25-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-27-0x0000000140000000-0x000000014030E000-memory.dmp
memory/5248-35-0x00007FF6AB9F0000-0x00007FF6AC065000-memory.dmp