b40e7badf3972fa45d8cb30e56ff8d51847166fc08f823acbceac2e0c998db6f

Analysis

max time kernel
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_4f538458f277c38e4e015511d240e45f_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_revil_stealc_vidar_zxxz.exe
Size 36.2MB
Sample260604-va9qcsa15w
SHA256 b40e7badf3972fa45d8cb30e56ff8d51847166fc08f823acbceac2e0c998db6f
MD5 4f538458f277c38e4e015511d240e45f
SHA1 78a3fe9d3fd713b9fa32b4149221441116a489df
SHA512 359137b11ecd7e75df91d1ef3902bc28f6027955afabfd6a9202f722328a455913695d61c3347f520beaeb535cb228e090d199e69d588201391fda1b78b5b330
SSDEEP 393216:J1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfL:JMguj8Q4VfvCqFTrY
TLSH
T1DD877B0773E60095E9B7D2388AA64507D773BC6343318ADF329D36151FBBAD09A7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2944	Hawi_23268704.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2944	4608	2026-06-04_4f538458f277c38e4e015511d240e45f_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_revil_stealc_vidar_zxxz.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-04_4f538458f277c38e4e015511d240e45f_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_revil_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_4f538458f277c38e4e015511d240e45f_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_revil_stealc_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\Hawi_23268704.exe
  "C:\Users\Admin\AppData\Local\Temp\Hawi_23268704.exe"
  2⤵
  - Executes dropped EXE
  PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hawi_23268704.exe

Path C:\Users\Admin\AppData\Local\Temp\Hawi_23268704.exe
Size 35.9MB
SHA256 7c1be46be3eb5fe37cee529a3a762f0c8f21b7a4ba9512574e26c6779ccd45c6
MD5 d2f2089639065aea8ed46837ec00e3c6
SHA1 dbcb245f22efc100809cac730d6195a3335054e8
SHA512 0d872edf0b20b59575e6d7e7aa77f0d7f3902e098dde8b2cd191e6f3d026a9e4be822cd5a5970d4ef73759567cdc3061974cf01595dbd99f48d47aa878fbe43a
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfV:fMguj8Q4VfvCqFTrY9
TLSH
T15E878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4608-0-0x00007FF9C3F45000-0x00007FF9C3F46000-memory.dmp

Download

memory/4608-1-0x00007FF9C3C90000-0x00007FF9C4631000-memory.dmp

Download

memory/4608-2-0x00007FF9C3C90000-0x00007FF9C4631000-memory.dmp

Download

memory/4608-7-0x00007FF9C3C90000-0x00007FF9C4631000-memory.dmp

Download

memory/4608-10-0x00007FF9C3C90000-0x00007FF9C4631000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads