Analysis
- max time kernel
149s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 22:16
General
- Target 2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_re.exe
- Size 55.2MB
- Sample260820-161efswfkd
- SHA256 d1a88ad6b1c9ea37fee1845ca3c8a5545a333bfa9894ff27c6e08cc97b87872e
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_re.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_re.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_re.exe"C:\Program Files\PDF Shaper Professional\PDFShaper.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dummyTLS64.dll
memory/1292-7-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-16-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-25-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-52-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-53-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-68-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-76-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-83-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-109-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-117-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-121-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-140-0x000000007FD80000-0x000000007FD90000-memory.dmp
memory/1292-130-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-123-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-120-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-119-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-118-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-116-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-105-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-104-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-103-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-102-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-101-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-100-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-99-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-98-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-93-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-86-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-85-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-81-0x0000000001FE0000-0x0000000001FF4000-memory.dmp
memory/1292-80-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-78-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-75-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-74-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-73-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-72-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-71-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-70-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-67-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-66-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-65-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-64-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-62-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-61-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-60-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-59-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-58-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-56-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-55-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-54-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-51-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-50-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-47-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-44-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-45-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-42-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-41-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-40-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-39-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-38-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-37-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-49-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-48-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-43-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-36-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-34-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-32-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-30-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-31-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-29-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-27-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-24-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-23-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-22-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-21-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-20-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-19-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-28-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-18-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-15-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-14-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-13-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-12-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-11-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-10-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-9-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-8-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-0-0x000000007FD90000-0x000000007FFDB000-memory.dmp
memory/1292-194-0x000000007FD90000-0x000000007FFDB000-memory.dmp