1a4c3357f3083c3467eb15fae1e3355cdaea26f307f5fc5f06cbf01b0dd52d45

General

Target
2026-04-15_96e7e38176d3b9eb13e0d22c2db97bf7_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 3.7MB
Sample260415-rn459abx4x
SHA256 1a4c3357f3083c3467eb15fae1e3355cdaea26f307f5fc5f06cbf01b0dd52d45
MD5 96e7e38176d3b9eb13e0d22c2db97bf7
SHA1 3d5d629080d208477365a6d9b03e1943119d37c8
SHA512 b7edb2931a1d29a83736f629fdee6dfd1692c81fb9692242c6576c5b4e18ea3dfc41b4e20ab50a84e0adb0b1b7151c69c346c16e98cc8b17941e423adfec3979
SSDEEP 49152:H6F0eMpAAYEhpNhwEbzPfJdTe3ygpa95HY0iLZegRNktSfsSCCe8pZaTUwg:u0nAAYEpNhdvJJfYLBTm8pUUd
TLSH
T103066B56F28680F8D42BC0B0860AD672F5317C494731A9EB5794FB253E73EE06B39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4732	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_96e7e38176d3b9eb13e0d22c2db97bf7_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_96e7e38176d3b9eb13e0d22c2db97bf7_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_96e7e38176d3b9eb13e0d22c2db97bf7_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3520
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 c9ab3a1b8770c3d0eeb86ad318c216d3bac22410effa4377ce16147d46527ecb
MD5 12428e291d15ff55387299ca8b381e6c
SHA1 b64df0f52a16aed085bc35ff1eea6d6aef3910bc
SHA512 54df2ce04345e11e519ee809ce50312bdd924e9041a7aa30ef12043f78695f5179c5222b4c54aaf1e37e8531aa720af4e6430148670a18e8c9fcd9cc7a2022a6
SSDEEP 393216:Telw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXR:TSWO1c877xqpyovvVWJ6VFK+q3cSvXR
TLSH
T1A15712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX44F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX44F3.tmp
Size 1.2MB
SHA256 bc29acaec76841b830534737354d60f9535f8607f6748708a39678d5ffd5efd9
MD5 3b495fd82d74d2ebfc62ffb3ef4fad99
SHA1 118ab16e45ba56e1c4862b23ad3e397d5bb1888e
SHA512 471b583af2a87a89bb60fdf330aa009dca3d2f2e1e9ca6c160f89fcc8908da149e19c6df68cd4218c5f29d8549b725fd8abd39b59fb5ed4b85b7d80d53d09a36
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOAIYA+wZW:H6F0eMpAAYEhpNhwE
TLSH
T1BD456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX47E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX47E4.tmp
Size 1.2MB
SHA256 db9587184d75af1558e43464525cb27d6864b5fdee4f4afb801ef7c3e6241387
MD5 5a372890cf284aa2aa8e629794c919ec
SHA1 150ee4437f4878ebab784198c07e55742eb3b59a
SHA512 b3994685aa12e11ac8cf81cfa2b4a8e91c39aae94c02bd1e060eb1eeed8920fada486c8146a170cabe355619a38970054719ac9a978b7295a0a88b6160126609
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnIYA+wvr:P6F0eMpAAYEhpuhwj
TLSH
T1D7456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX47E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX47E5.tmp
Size 1.2MB
SHA256 8b9d7537a168d33cc0e4c586ea020ac500ac4c78f9e0f4ad427863328be4e061
MD5 86bae2fb2f6a622dbe469df499a0f9f9
SHA1 a45f0b2502bfe203cbb46b5264ecc7d03ee25a8e
SHA512 ab27db7329c9691f1d226e3c43a96005b224caa731d1e67e740dba5547fba716767fced60f8ef8575e968179cec20e04f5603ba0547ffae86c78844a8a20c777
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOJIYA+wZ+:n6F0eMpAAYEhpAhwM
TLSH
T1CC456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.6MB
SHA256 7aed0c05e7db0a1f9f5d38302e7b8f3df3b18192af09e06bcf5f616ba3de9553
MD5 eb157504645dc48d4d8ec79aa8f1fe45
SHA1 85c51e657db9c691e1b5f2c62475d5c27ecc3681
SHA512 d1689f2b792a2e5f31266bfd96ba3cf950058a446a5bb51651350e78baaa96a9ff794407d5f793c9a106dea7b2931a02ddccb39f2bcbcdeda0d83b63c488b525
SSDEEP 49152:/zPfJdTe3ygpa95HY0iLZegRNktSfsSCCe8pZaTUw:LJJfYLBTm8pUU
TLSH
T138C55B13F29A40E8D02AD0B8C7069232F9757C454B35A9EF0794BB252E77FE46B39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3520-278-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads