Overview

overview

4

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

4

2026-08-23...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 22:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_c1f2b69c9bdf021f1e460d9e659a1d47_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  • Size 681KB
  • Sample260825-125hlseq8w
  • SHA256 70d59b875aec408c8eff9049721b7b147f95641a31f80c19818f2cecc4a8acc6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 48 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1f2b69c9bdf021f1e460d9e659a1d47_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1f2b69c9bdf021f1e460d9e659a1d47_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1f2b69c9bdf021f1e460d9e659a1d47_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1f2b69c9bdf021f1e460d9e659a1d47_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3600
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 472
        3⤵
        • Program crash
        PID:1664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 472
        3⤵
        • Program crash
        PID:5500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 512
      2⤵
      • Program crash
      PID:1992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 556
      2⤵
      • Program crash
      PID:792
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2500 -ip 2500
    1⤵
      PID:3124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2500 -ip 2500
      1⤵
        PID:6116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3600 -ip 3600
        1⤵
          PID:2516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3600 -ip 3600
          1⤵
            PID:1792

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX3EF5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX3EF5.tmp
                • Size 532KB
                • SHA256 bd1ef175cd938f10c3a628ed3e49aec5899415dae069910185f1257911530687
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCXA18C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCXA18C.tmp
                • Size 522KB
                • SHA256 5e76c6b13ff65e5a0d1dbe8e48a80326c2d1051dfe32d8e97c4b4b1e821ea960
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3791.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3791.tmp
                • Size 799KB
                • SHA256 58fe59d12c458d706f4ffc44231d2c8f4f8bcf3e07e7e6f532f1d430378bcfc4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc37A3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc37A3.tmp
                • Size 1.2MB
                • SHA256 f92e05d54b14e6ff7d5d7e0cc86e7b51b74b2ebd0d2112064c99c43a330b67fa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3B6F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3B6F.tmp
                • Size 942KB
                • SHA256 3020a6919cf2f35ac28b846dbc3f3665290ceb8819b7cea1dd3295e278f4e946
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3B82.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3B82.tmp
                • Size 265KB
                • SHA256 12b89ab506cd8169a2b495d6d6aeba5d48c942791f4bd4d7586304eba26ae4c2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3EB1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3EB1.tmp
                • Size 2.4MB
                • SHA256 a3363c6f8221a93117219a5141e3597804b55d38031d0f1d699c313c4e33d26f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4CFF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4CFF.tmp
                • Size 298KB
                • SHA256 697e5d57115d229624765558901440c85ce3ef9856f0ef70b1f48f48c8aaa66b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4D12.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4D12.tmp
                • Size 4.3MB
                • SHA256 1cca0d42d9bf538f4b34c7004b3f562e32080153260d4065f179378342455e03
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc4D63.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc4D63.tmp
                • Size 610KB
                • SHA256 35100aa6da5e2ca51649aafc54d18777598db6fcfacdf36b11d8e35bd45b3245
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc57C6.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc57C6.tmp
                • Size 23.7MB
                • SHA256 dc7f82d67459dcc69b2e8cacb61f0eead80acfe297982c60656892fad297089d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc614F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc614F.tmp
                • Size 681KB
                • SHA256 a0bc9ad9dd6bc7e00455f31d5bf744f6644f8ea18ed12213f779afd97f3d9b14
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc6F62.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc6F62.tmp
                • Size 830KB
                • SHA256 7e919e75554951e599839b20306e981eb5fdf2eb00aa72a48937e6ff1e8f7b48
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc70BC.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc70BC.tmp
                • Size 508KB
                • SHA256 8f59c44cdcb9b3fe703def5d7260f5cbe9c639b012b485942168c87de012a509
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc70CF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc70CF.tmp
                • Size 347KB
                • SHA256 8d82c13d6d6379656a657b64525a5ff462f1779b2b36a0c5091ee30b1d629c7e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc7D25.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc7D25.tmp
                • Size 394KB
                • SHA256 c1b5ffd758da950268ac3a6a6cf8b62f2e8ed9dd30007c0647e7226703233e69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc8BAE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc8BAE.tmp
                • Size 488KB
                • SHA256 0b230e16a8782b0ee33c3bba87ed6d5314afeec328ecff0cafacba5181ef7dd2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc8BD1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc8BD1.tmp
                • Size 4.4MB
                • SHA256 1cb557c8b1a731b86de7976b2fea30191362ec738bc9dcdbe3af0e0a14a93894
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9126.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9126.tmp
                • Size 3.6MB
                • SHA256 2229b54491dde109f76d1e2e65776f91592e215d3b77d73a1742f6465aba7aee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9139.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9139.tmp
                • Size 284KB
                • SHA256 25a1455fc559ce47387901f8a4b8533ecc344a5464f276a6edb602da628b7ae3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA139.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA139.tmp
                • Size 917KB
                • SHA256 81ee4bc27a961af9d74c73006a63f272a5fd9a95eb26c418f095077c02120353
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA93E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA93E.tmp
                • Size 435KB
                • SHA256 022db7f42294ac8abf103a37d0c67f0aa90ca99bb2fbaedadbcdaf82d4619a77
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA951.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA951.tmp
                • Size 815KB
                • SHA256 17bfe4b239d3842436141f9d5dec4107e377c80f5d45cd6a1bdee3bd03f4223f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA954.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA954.tmp
                • Size 333KB
                • SHA256 e83c3b263cfc5774b741d7aa8d30299587cb6fff2c9b4e494641f1ec10b4def5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA966.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA966.tmp
                • Size 390KB
                • SHA256 ab8c386ec9cb9b7699dc3b1a29b5477b14cda5260543edf5324fb99311d03489
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA979.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA979.tmp
                • Size 315KB
                • SHA256 28cddf84d6f8c35c1c7bc9d03a199aa8811a130e26f325be133ef84e98711ae1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA98C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA98C.tmp
                • Size 705KB
                • SHA256 d7d7eb27b4d8a6e6747833a2d08a142ebcfd99fb662ae46e0d869edf728f8358
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcAFC8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcAFC8.tmp
                • Size 1.6MB
                • SHA256 8c62179cf884f7574aede2581b29ff01ba6f5ac75968169bd2aaf416d246b713
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcAFDB.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcAFDB.tmp
                • Size 488KB
                • SHA256 8a2e2c0d23fc8609bc63bac2496e4e189ef247f704acf8462429c9e455c1e944
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcAFEE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcAFEE.tmp
                • Size 391KB
                • SHA256 c72961ef710d1e9889f5ad68c3f39819ef1c67c359f327b16aa30e0f975cd7f5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2500-80-0x0000000000400000-0x00000000004B4000-memory.dmp
                Download

                memory/2500-128-0x0000000000400000-0x00000000004B4000-memory.dmp
                Download

                memory/3600-212-0x0000000000400000-0x00000000004B4000-memory.dmp
                Download

                memory/3600-311-0x0000000000400000-0x00000000004B4000-memory.dmp
                Download