98ce5ba4265c72f090c4ba081133d5a253c9d70630882a6ce3abaec8e7b632a6

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample261003-rbed3ade95
SHA256 98ce5ba4265c72f090c4ba081133d5a253c9d70630882a6ce3abaec8e7b632a6
MD5 4036f0b0d8c6dcb68cc7b3604dc7dfd3
SHA1 843ee5a02432c4b2788916b35922ba992e3971af
SHA512 2c9bce5c019b330646ada7858db81ff7a4adf5b81b7ed7f6a84e00ee63af62b9871457b8b302b99b984fc5e26d32a7039ec05fc906f890d69aabbd30b67532d8
SSDEEP 12288:t2Jbc2yYltyimI1oWPGD36eU+N3PsEqtpn0KPRTSl/XalFW9F1i7jpiho3FMtJl:t2Jb8ds436epN7w3PROWFW9sQ0MtJl
TLSH
T15E559D2BB6D540F9D02AC5788A568172E972BC521F34A6DF06D0B7192F3BAE42F3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3196	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.tmp
6120	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm
4464	GOG.exe
3836	GOG.exe
3188	GOG.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe"	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe"	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe"	GOG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe"	GOG.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\GOG.exe	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm
File created	C:\Windows\GOG.exe	GOG.exe
File created	C:\Windows\GOG.sys	GOG.exe
File opened for modification	C:\Windows\GOG.sys	GOG.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOG.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0"	GOG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2	GOG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1"	GOG.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
4756	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
3836	GOG.exe
3836	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe
4464	GOG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 6120	4756	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe	90
PID 6120 wrote to memory of 4464	6120	2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm	91
PID 3836 wrote to memory of 3188	3836	GOG.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.tmp
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm
  C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\GOG.exe
    C:\Windows\GOG.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4464

C:\Windows\GOG.exe
C:\Windows\GOG.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\GOG.sys
  C:\Windows\GOG.sys /zhj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.mm
Size 209KB
SHA256 a71091c521455f7faae16c1a6aa71a558a292a4da4c222372a7101ee5623197a
MD5 70b653bc9e32fcb768955495300a3dc6
SHA1 d68d72f476d0f7163f19b7b42c297d6f9bda6aa0
SHA512 716f20ff277b93b55dd5d3f875d16fc398d697a735d8de9b69b51a77358342de27317f5315839629484d48973b01ab32a7ca8a8c7408b468ee4fc322d69fd8d2
SSDEEP 3072:sAs9EzdgAnEFJaJgb6CCAn2Ix2lOqMLZssem5WrkwyQC3ZDCKAr2UmSiyVQB6O4e:gazdMJb6CqIqOq2eJCdlSgyVQN41RoV
TLSH
T107246C7BF6918833D0721A7C8D6992E5B439BF302D29645F7AE41F4D9B391D12A2C383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_4036f0b0d8c6dcb68cc7b3604dc7dfd3_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid_njrat_vidar.tmp
Size 1.0MB
SHA256 09812edc4f8ab46b6d3535542b35c578bfc3da81ff56ff7148e539fcf90ef7da
MD5 2597aa6ae97e33320dfcb968c18128b3
SHA1 9366e7a9c66809a7480119ef241b95fd82cb55ba
SHA512 4999d490f3a95ba3d5a08b93dd1555969cc15b2295c8294304b19b6b55b0957bb7ef4c3a632c19998835bd8f1637b22298b897733cd910d25d13855dedf36bce
SSDEEP 12288:3oWPGD36eU+N3PsEqtpn0KPRTSl/XalFW9F1i7jpiho3FMtJs:3436epN7w3PROWFW9sQ0MtJs
TLSH
T104358D17B6D540E8D02AD5748B568132EA72BC560B30AADF07D0F2192F7BAE46F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3188-33-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/3188-32-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/3836-31-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/4464-15-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/4464-73-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/4464-74-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/4756-1-0x000000000042F000-0x0000000000430000-memory.dmp

Download

memory/4756-0-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/4756-72-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/6120-13-0x0000000000400000-0x000000000043B08D-memory.dmp

Download

memory/6120-16-0x0000000000400000-0x000000000043B08D-memory.dmp

Download