Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 03:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
- Size 5.4MB
- Sample260907-ejmzyswwfv
- SHA256 22c9e82785d49f71c2cdefcd8946a06d0a280ff7b2301546da6775b3d427e518
- MD5 4902d70150fc1bf0555c98adc3202e50
- SHA1 0eba4ad219f4caf0485f9f41aca5e9c1e93828b1
- SHA512 97ee4bf255bb901a00599ee173f61ac0ae9bdceb735b50ea9854e787a2a34e6c52bfc05dd8d730a718dc4356fba7fc1aa0a7fd1f90657dad70b365a218a79100
- SSDEEP 98304:mkmygWQtZ/K0tGOFWVRuLQJJfYLBTm8pUUQ:kWyZ/K0ttYVAMUB/pM
- TLSH T138466A13F29640E8D01ED17987469232F9727C890B35B5EF0690BB662E77EE06B3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with MEW 29 IoCs
resource yara_rule behavioral1/memory/4132-0-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4132-3-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4132-2-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/files/0x000a0000000244c7-12.dat INDICATOR_EXE_Packed_MEW behavioral1/memory/4708-15-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4708-13-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4708-21-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-19-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/1868-32-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/3868-47-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/1868-45-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4132-43-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/3868-42-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-87-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4132-88-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-89-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-91-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-93-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-95-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-97-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-99-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-101-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-103-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-105-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-107-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-109-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-111-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-113-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral1/memory/4988-115-0x0000000000400000-0x0000000000472000-memory.dmp INDICATOR_EXE_Packed_MEW - Executes dropped EXE 5 IoCs
pid Process 4256 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp 4708 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm 4988 GOG.exe 1868 GOG.exe 3868 GOG.sys - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened (read-only) \??\B: 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.sys GOG.exe File opened for modification C:\Windows\GOG.sys GOG.exe File created C:\Windows\GOG.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm File opened for modification C:\Windows\GOG.exe 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4132 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 4132 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 1868 GOG.exe 1868 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe 4988 GOG.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4132 wrote to memory of 4708 4132 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 87 PID 4708 wrote to memory of 4988 4708 2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm 88 PID 1868 wrote to memory of 3868 1868 GOG.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmpC:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp2⤵
- Executes dropped EXE
PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mmC:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
-
C:\Windows\GOG.exeC:\Windows\GOG.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\GOG.sysC:\Windows\GOG.sys /zhj2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3868
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
- Path C:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.mm
- Size 2.8MB
- SHA256 8509a4ea2f2b70a8022c02a0c805738f7c536befbd1d57b6b016f6e1c1f8b1da
- MD5 73b9945bed1598618a3b4f82d2147a72
- SHA1 6f987e5ba52185cf812b3095e8f650a3fc865d6c
- SHA512 6dfc50f79a3a4d88f466607beb4a3a8bf9988cf3bcb2e1b973d87c3b1492e2e3770df12528f8d082baf0e3d7d8227ccbd60b0baa6e199e4696cf785b69ae9197
- SSDEEP 49152:mkmyT/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+x:mkmygWQtZ/K0tGOFWVRuLC
- TLSH T1CBD57B13F19500EDD05ED179874AA232F972789A0B35B5DF0AE09B662B3BEE0673C711
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
- Path C:\Users\Admin\AppData\Local\Temp\2026-09-06_4902d70150fc1bf0555c98adc3202e50_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.tmp
- Size 2.6MB
- SHA256 7aed0c05e7db0a1f9f5d38302e7b8f3df3b18192af09e06bcf5f616ba3de9553
- MD5 eb157504645dc48d4d8ec79aa8f1fe45
- SHA1 85c51e657db9c691e1b5f2c62475d5c27ecc3681
- SHA512 d1689f2b792a2e5f31266bfd96ba3cf950058a446a5bb51651350e78baaa96a9ff794407d5f793c9a106dea7b2931a02ddccb39f2bcbcdeda0d83b63c488b525
- SSDEEP 49152:/zPfJdTe3ygpa95HY0iLZegRNktSfsSCCe8pZaTUw:LJJfYLBTm8pUU
- TLSH T138C55B13F29A40E8D02AD0B8C7069232F9757C454B35A9EF0794BB252E77FE46B39B11
- MD5 SHA1 SHA512 SSDEEP TLSH