Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
- Size 3.2MB
- Sample260815-d55lfsdf58
- SHA256 9612920ad728024aa34d23c1d008f649ef45005bb6c03b92ce6c5904fe70ac4a
- MD5 860d81cc77fcbf05c852b3f54b63ff24
- SHA1 8274b2248bd318062aff50fa9d119c9b06c473b6
- SHA512 7a670d911c6a31bd7aa453fe55b5eecc8837f74cadd576ed4fa35c9302685a3d789847f41723934454d04dd03fb5359769dfc12407a2c61371aa0531637c49ac
- SSDEEP 49152:PDPkB5FREPtAxrCcGU8+kB4gb3OP1m8vPHve/idPYuAbRlmZF8O:PIpxrXGxqvO/cPY8
- TLSH T15DE5C4026BEC0418F5F32B788A7A99509A3BBC560B38D5DF01981D5D0F73AC29D76B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dvdplay.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\WWAHost.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\label.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\netsh.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\sc.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\systray.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\finger.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\diskusage.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\relog.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\sudo.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\regedit.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\comp.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\compact.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\cscript.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\hh.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\notepad.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\splwow64.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\winhlp32.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\bfsvc.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\explorer.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Windows\HelpPane.exe 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2608 4612 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_860d81cc77fcbf05c852b3f54b63ff24_amadey_badda_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 6242⤵
- Program crash
PID:2608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 236 -p 4612 -ip 46121⤵PID:5804