Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 15:54
General
- Target 2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe
- Size 22.6MB
- Sample261102-tcfpmavway
- SHA256 b319f3964c6dce387fae4554b3de199021e70738ee73cb9bce8715571e19d937
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
- Drops file in Drivers directory 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 51 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 16 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Addon\SUPORTE.exe"C:\Addon\SUPORTE.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Addon\PRIVATE-USER.cmd" "2⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"3⤵
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\system32\drivers\etc\hosts3⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\system32\drivers\etc\hosts3⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
-
-
C:\Addon\BACKUPPER.exe"C:\Addon\BACKUPPER.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QTOHI.tmp\BACKUPPER.tmp"C:\Users\Admin\AppData\Local\Temp\is-QTOHI.tmp\BACKUPPER.tmp" /SL5="$8027E,21140175,58880,C:\Addon\BACKUPPER.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create HWiNFO32 binpath= "C:\Windows\SysWOW64\drivers\HWiNFO64A.sys" DisplayName= "HWiNFO32/64 Kernel Driver" type= kernel start= demand4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Driver Booster\DriverBooster.exe"C:\Program Files (x86)\Driver Booster\DriverBooster.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Driver Booster\HWiNFO\HWiNFO.exe"C:\Program Files (x86)\Driver Booster\HWiNFO\HWiNFO.exe" /brandname5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Driver Booster\Manta.exe"C:\Program Files (x86)\Driver Booster\Manta.exe" /CommStat /DoCommStat /Code="a602" /Days=05⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Driver Booster\AutoUpdate.exe"C:\Program Files (x86)\Driver Booster\AutoUpdate.exe" /main /App=db11 /MainHwnd=05⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Driver Booster\RttHlp.exe"C:\Program Files (x86)\Driver Booster\RttHlp.exe" /cnt5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Driver Booster\Manta.exe"C:\Program Files (x86)\Driver Booster\Manta.exe" /CommStat /DoCommStat /Code="A100" /Days=05⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Driver Booster\Manta.exe"C:\Program Files (x86)\Driver Booster\Manta.exe" /CommStat /DoCommStat /Code="B100" /Days=75⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Driver Booster\RttHlp.exe"C:\Program Files (x86)\Driver Booster\RttHlp.exe" /stat5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Driver Booster\SetupHlp.exe"C:\Program Files (x86)\Driver Booster\SetupHlp.exe" /afterupgrade5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\SysWOW64\drivers\HWiNFO64A.SYSC:\Windows\SysWOW64\drivers\HWiNFO64A.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Replay Monitor
Loading Replay Monitor...
Downloads
BACKUPPER.exe
PRIVATE-USER.cmd
SUPORTE.exe
AutoUpdate.exe
DataState.dll
DriverBooster.exe
HWiNFO.exe
is-F7RNK.tmp
Arabic.lng
Bulgarian.lng
Catalan.lng
ChineseSimp.lng
ChineseTrad.lng
Czech.lng
Danish.lng
Dutch.lng
English.lng
Finnish.lng
French.lng
Georgian.lng
German.lng
Greek.lng
Hebrew.lng
Hungarian.lng
Indonesian.lng
Italian.lng
Japanese.lng
Korean.lng
Latvian.lng
Manta.exe
PowerMgr.dll
ProductNews2.dll
Register.dll
RttHlp.exe
scan.dat
SetupHlp.exe
SysRest.dll
WebRes.dll
Zip.dll
madBasic_.bpl
madDisAsm_.bpl
madExcept_.bpl
rtl120.bpl
sqlite3.dll
vcl120.bpl
DBRtt.ept
HWiNFO64A_151.SYS
Portable.bmp
innocallback.dll
BACKUPPER.tmp
Config.ini
Config.ini
Config.ini
HWiNFO64A.SYS
hosts
memory/1324-587-0x0000000000400000-0x00000000004F8000-memory.dmp
memory/1324-45-0x00000000052B0000-0x00000000052C5000-memory.dmp
memory/1324-586-0x0000000000400000-0x00000000004F8000-memory.dmp
memory/1324-64-0x00000000052B0000-0x00000000052C5000-memory.dmp
memory/1324-63-0x0000000000400000-0x00000000004F8000-memory.dmp
memory/1420-678-0x0000000000400000-0x0000000000431000-memory.dmp
memory/1420-633-0x0000000010000000-0x0000000010237000-memory.dmp
memory/1744-30-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1744-62-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1744-588-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1880-847-0x000000000A1C0000-0x000000000A319000-memory.dmp
memory/1880-614-0x0000000006690000-0x0000000006761000-memory.dmp
memory/1880-1005-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1880-583-0x0000000001300000-0x0000000001397000-memory.dmp
memory/1880-921-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1880-893-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1880-659-0x000000000C570000-0x000000000C602000-memory.dmp
memory/1880-879-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1880-865-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1880-585-0x00000000013A0000-0x00000000015CF000-memory.dmp
memory/1880-592-0x0000000005EB0000-0x0000000005FBD000-memory.dmp
memory/1880-863-0x0000000000400000-0x0000000000CD4000-memory.dmp
memory/1880-616-0x000000000A1C0000-0x000000000A319000-memory.dmp
memory/1880-615-0x0000000006770000-0x000000000680C000-memory.dmp
memory/1880-837-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1880-841-0x0000000061E00000-0x0000000061ECA000-memory.dmp
memory/1880-836-0x0000000059800000-0x000000005986E000-memory.dmp
memory/1880-835-0x0000000000400000-0x0000000000CD4000-memory.dmp
memory/1880-838-0x0000000057000000-0x000000005703F000-memory.dmp
memory/1880-839-0x0000000057800000-0x0000000057812000-memory.dmp
memory/1880-840-0x0000000050120000-0x000000005030D000-memory.dmp
memory/1880-842-0x0000000001300000-0x0000000001397000-memory.dmp
memory/1880-843-0x00000000013A0000-0x00000000015CF000-memory.dmp
memory/1880-844-0x0000000005EB0000-0x0000000005FBD000-memory.dmp
memory/1880-846-0x0000000006770000-0x000000000680C000-memory.dmp
memory/1880-845-0x0000000006690000-0x0000000006761000-memory.dmp
memory/1880-848-0x000000000C570000-0x000000000C602000-memory.dmp
memory/2608-852-0x00000000026C0000-0x00000000027CD000-memory.dmp
memory/2608-856-0x0000000000400000-0x0000000000421000-memory.dmp
memory/2608-857-0x0000000050000000-0x0000000050116000-memory.dmp
memory/2608-859-0x00000000026C0000-0x00000000027CD000-memory.dmp
memory/2608-858-0x0000000050120000-0x000000005030D000-memory.dmp
memory/2732-860-0x0000000000400000-0x000000000064C000-memory.dmp
memory/2732-853-0x0000000003D20000-0x0000000003E2D000-memory.dmp
memory/2732-861-0x0000000050000000-0x0000000050116000-memory.dmp
memory/2732-862-0x0000000003D20000-0x0000000003E2D000-memory.dmp
memory/2780-820-0x0000000050000000-0x0000000050116000-memory.dmp
memory/2780-822-0x00000000026B0000-0x00000000027BD000-memory.dmp
memory/2780-805-0x00000000026B0000-0x00000000027BD000-memory.dmp
memory/2780-821-0x0000000050120000-0x000000005030D000-memory.dmp
memory/2780-819-0x0000000000400000-0x0000000000421000-memory.dmp
memory/3680-552-0x0000000000010000-0x000000000001A000-memory.dmp
memory/4364-814-0x00000000027B0000-0x00000000028BD000-memory.dmp
memory/4364-811-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/4364-812-0x0000000050000000-0x0000000050116000-memory.dmp
memory/4364-813-0x0000000050120000-0x000000005030D000-memory.dmp
memory/4388-818-0x00000000027E0000-0x00000000028ED000-memory.dmp
memory/4388-815-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/4388-817-0x0000000050120000-0x000000005030D000-memory.dmp
memory/4388-816-0x0000000050000000-0x0000000050116000-memory.dmp
memory/4388-810-0x00000000027E0000-0x00000000028ED000-memory.dmp
memory/4708-662-0x00000000027B0000-0x00000000028BD000-memory.dmp
memory/4708-635-0x00000000027B0000-0x00000000028BD000-memory.dmp
memory/4708-639-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/4708-661-0x0000000050120000-0x000000005030D000-memory.dmp
memory/4708-660-0x0000000050000000-0x0000000050116000-memory.dmp