Overview

overview

7

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

7

2026-08-09...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 15:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_e85367fb4aabd2f9abb18bd9713a87e8_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 623KB
  • Sample260809-s8za6sbb67
  • SHA256 10dd10a6c19c4b8a9c1dbee869704cc3a78e1a68c5ddc3a18026bcbd422ace17
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 12 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_e85367fb4aabd2f9abb18bd9713a87e8_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e85367fb4aabd2f9abb18bd9713a87e8_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 512
      2⤵
      • Program crash
      PID:2108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 512
      2⤵
      • Program crash
      PID:5940
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3584 -ip 3584
    1⤵
      PID:4736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3584 -ip 3584
      1⤵
        PID:3020

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RCXC157.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCXC157.tmp
            • Size 741KB
            • SHA256 f01fa579f029b10d1c460953f09f7f052168567aa4ae8380713d8e561708a536
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcC104.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcC104.tmp
            • Size 771KB
            • SHA256 b84dcfcf9ff21ff2316d10135e6dc991622f2c3a860393f5ce6f16fd4bf7e3e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcC3E9.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcC3E9.tmp
            • Size 1.1MB
            • SHA256 a358648b99ce7ad3547cd06abbe2a84a651e0102f7a84b38c0bfaad7b3775599
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcC3FB.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcC3FB.tmp
            • Size 884KB
            • SHA256 3aaeec3e2aaca22eacba665d57054eca5ba46ae84cdb4ca818200afe2bb0f0b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcC40E.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcC40E.tmp
            • Size 206KB
            • SHA256 cfb458aaf64ac7aade9524bea598ad0841200683bd904e8f4fbd0d15293308f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCEBF.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCEBF.tmp
            • Size 2.3MB
            • SHA256 c9e4e189462a49dc33c05082fee7dd21edf1f1d0cf5f590ae97d82d22e8b9853
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCED2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCED2.tmp
            • Size 474KB
            • SHA256 d57f0b6acf2ec16d20a20fa75387f5382220ff0d530073d7d3a4c6cb51beb03d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCEE4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCEE4.tmp
            • Size 240KB
            • SHA256 af69072a3193032bc31b50d0f47adc7d898160526ad6b7e2b93dbf5bf2bd1deb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcCEF7.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcCEF7.tmp
            • Size 4.3MB
            • SHA256 b10e2332c4479450a3ca9f1d2a5e477eb498379f739fb45b911e703cf434e430
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcD0B0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcD0B0.tmp
            • Size 551KB
            • SHA256 16e07a3a95c75dc4a5b6ac8b436d672d9c8dadd903963af0af85edb2392d48d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcD0D2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcD0D2.tmp
            • Size 23.7MB
            • SHA256 da3e105636c0272cafeef7885b113d70c6e821bd675fc8d0b3304b551f50a262
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3584-88-0x0000000000400000-0x00000000004A6000-memory.dmp
            Download

            memory/3584-91-0x0000000000400000-0x00000000004A6000-memory.dmp
            Download