Overview

overview

7

Static

static

3

2026-08-20...ar.exe

windows10-2004-x64

7

2026-08-20...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 11:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_ac4ba523709e5e34cb8b73d7705c259a_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 1.7MB
  • Sample260820-nrpceswckd
  • SHA256 977c6c61aa63cbd0dcc2f9759e96e625599c5afa21f267a9d50f9ac8b2e39922
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 11 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ac4ba523709e5e34cb8b73d7705c259a_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ac4ba523709e5e34cb8b73d7705c259a_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 512
      2⤵
      • Program crash
      PID:4212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 512
      2⤵
      • Program crash
      PID:4448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3788 -ip 3788
    1⤵
      PID:5476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3788 -ip 3788
      1⤵
        PID:2832

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RCX360B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX360B.tmp
            • Size 737KB
            • SHA256 6493b235f1d67d73d58856dfe65e7d3f9a7e2215f40019cbcd366a6e120dd455
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc27B2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc27B2.tmp
            • Size 1004KB
            • SHA256 50dbb4c3379c63f5ef2e61781cd2ec2aa619be6d03bb2ebf311a025c9e80577d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc27D4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc27D4.tmp
            • Size 1.4MB
            • SHA256 9e630e04e1856f835a5b5fdc3052983b5a4cd63503afa9ed7b9d5a7d1842701a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc27F7.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc27F7.tmp
            • Size 1.1MB
            • SHA256 9003aae19dab3276351f62e2a9df8179bd6a98b1719373856180a69e7ffd219e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc2951.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc2951.tmp
            • Size 470KB
            • SHA256 e337380854d5115ffd1088ce1e4a83fd6708788caa85bb8b23f7d7afa2500f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc2964.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc2964.tmp
            • Size 2.6MB
            • SHA256 52a4c1825007a80dd32e8aa10961ffc5357b5b9e643d90fc088f678547f535c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc360C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc360C.tmp
            • Size 503KB
            • SHA256 b08b52406bbc550f1cebdf86bbd800d53ff7fecb95e3b6f4840d8bc08122275f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc362F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc362F.tmp
            • Size 4.5MB
            • SHA256 833dbca76d7bcf93d3c0a14fb8cfbfc7c3cee9d173748bf6120cc10017e7ca28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4228.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4228.tmp
            • Size 814KB
            • SHA256 b85c74aaa1b4a0950d067e0ae9827b821817bc0e10e32702cdf61bb7980b819c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4289.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4289.tmp
            • Size 23.9MB
            • SHA256 d6631aa52ff5f3ee072e179a6c0b186846a25ff61d11e275a32e56c7a80531cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3788-82-0x0000000000400000-0x00000000005B2000-memory.dmp
            Download