ee7a2d95b931838e16cba370aa4a18c0481635a4529f2580c0b6af2e08e72eff

General

Target
2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Size 657KB
Sample260808-vkhdvs1djf
SHA256 ee7a2d95b931838e16cba370aa4a18c0481635a4529f2580c0b6af2e08e72eff
MD5 f5bd1897aaacc517ed3efa5959c4e1c4
SHA1 9fce8e0d5524bb97c29253ebcc25914d192db2b0
SHA512 61946d845daf64546c45597d882bfb6edf7591bc782896ba0962784001347f87c11169504fe87a8285da77d920d29ae5a1af3335cab2ad6e91f86dc3bf25f15e
SSDEEP 12288:1W4m8ntE9G6DMz4D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftH:o4mW8GLmJVJTt4D7/SAOZi+5v48cKf9
TLSH
T167E49E16B3E044F6E0B7D238CEA65711E9767C155B30D64F13A8966E0F237609E3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5840	2372	WerFault.exe	87
2768	2372	WerFault.exe	87
1876	5000	WerFault.exe	89
2104	5000	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2372	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
2372	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
5000	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
5000	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 5000	2372	2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5bd1897aaacc517ed3efa5959c4e1c4_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 436
    3⤵
    - Program crash
    PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 436
    3⤵
    - Program crash
    PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 552
  2⤵
  - Program crash
  PID:5840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 552
  2⤵
  - Program crash
  PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 236 -p 2372 -ip 2372
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2372 -ip 2372
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5000 -ip 5000
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5000 -ip 5000
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pUc267.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc267.tmp
Size 775KB
SHA256 59f669ad574da6385e2a06b00d8490e221c8eac5205dd3c0e8f43b7873f95d36
MD5 ba0736e9ee6b8226d20b500c8913a5e7
SHA1 c2e7cd3fd8176f7ddb84db4d753d05b15e0ba08d
SHA512 908919d18cbba89f1e26d7a6f44f4a8a85df48abc6a41ce0c0a010f9e0ebb22a4910b0b4e79561b28e5a16188f8829ebe28a58cd3b562570732894c935c0ed4c
SSDEEP 12288:IW4m8ntX9G6DMzZXZNYVLeyUji0h90ZD0wxpGZIVuKrHsL:/4mWtGLj0Le5ji0hmxNrML
TLSH
T15CF45B26F5B48331D073C0B9C9D2A69AE97135811B308ACB4395D76C7F677E68A36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc2F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc2F0.tmp
Size 2.3MB
SHA256 b9cf13dd457ce8c6ce2f0ce9edce44fde120fb1ef3719372d5a8af2fe3be6e79
MD5 064db3b93861fb45469d0cd78d2f817e
SHA1 c9148681d4728729a7a941511f7cd15b1add03a2
SHA512 9a620e6a4f23624e6a83529ca780240763943c45b12807d7c5f7525e059b59d3179543de571c9c3e7ca8a4f97d2263be78d6b1a7e0fa90059381832b111a3623
SSDEEP 24576:i4mWPGLMCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344r:RmcCbRquA/m2yL5zbfFiV+XenmE3/zm
TLSH
T18FB56B1A76A8C1B4D1F6C77886A6C647F37178154B309BEF5265460E2E33BE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc322.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc322.tmp
Size 508KB
SHA256 e12baeb01cce4f1db2e7a0fca4a76ef7b7e43538c4a5a8a66ca3507e2db66203
MD5 6bfa1956a7d59338253ec6a9749b6360
SHA1 14d5e9e9cd5ff0766305b95ed10ce03241a57a97
SHA512 c94872ff72bc636160e30a354f57fe94b32628e7e9271cb938984ec1f8f32c35f32766f39d93791ad7ffa2c940826db045a947d21759841384b523a19cd6dc52
SSDEEP 6144:pFQ4afbQz3TOe6my2PcOq6KpCHNN7e9G6DMz9OOr/BJ/GKWWBNU6ITLBi0qttcl9:pW4m8ntc9G6DMz8eBNUbTVO86UB
TLSH
T112B44B3BFE64ECF2C17A4DB85AA58600D77679304F2193CBE265830DDE236E05E36916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc335.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc335.tmp
Size 274KB
SHA256 36c3e47d85dccb91f714dfe6c25ef4addd2a1f35ad1371070b90db75bb9193b2
MD5 45f0deec387e2ea60923f4105143982e
SHA1 d05da4758c168f28737bbd892d234a866ab2bb43
SHA512 8bd3563b9aeecad82062d430aa3fa210a66aa8dbf2dff27fca3a7129f74d00f8ecb67754fbc9e6a1359e48c4658d0751f115944401113da7c6b8c505b22bfe78
SSDEEP 6144:BFQ4afbQz3TOe6my2PcOq6KpCHNNDe9G6DMzScr0Xa:BW4m8ntU9G6DMzS8
TLSH
T15E54BE21B2D0C437E0A30BB45EFAA232593DFF512E21865F67E46E4D9EB23D05A12357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc379.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc379.tmp
Size 586KB
SHA256 3f29cae17053523cd6b3ce3bbedf681597d89f68855c904c10dc350958dd45b0
MD5 df01f32da2162815609d8964ebc1dac0
SHA1 e2e5a856af5c188f984f9980547dd5b60d2132e2
SHA512 89ae74664e222b4fbfbe6cf9a5af0f52cf866921580b9d60b0f90d3f966c3e719d9f147077dfb41e528193f4a1d768c8bb631a6641087b60514d1a72534a8d48
SSDEEP 12288:BW4m8ntY9G6DMzPAwSfxL/2Dc3jDLLmt0LDQewsAjR9:k4mWwGLsaewsAjf
TLSH
T163D48D31FAB0D436C2BB0DB11B7AD726543DBA200F6119C7E3E89E9D59702D12736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2372-82-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5000-85-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads