a2e8c45e55b9133b050154f9fc2f82ecf3343f6cf8b90b123d412fcc78dc414a

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_e7e2d9a990a9319ee4d5e2df137f88a3_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar.exe
Size 9.6MB
Sample260629-b7efyaaw6x
SHA256 a2e8c45e55b9133b050154f9fc2f82ecf3343f6cf8b90b123d412fcc78dc414a
MD5 e7e2d9a990a9319ee4d5e2df137f88a3
SHA1 dd9220ce550ec6ca32295b47cadd1a294c60cdcc
SHA512 347c845a9ac4eace169fb876b33fbd1a2efcb83876512f53e4c80469c14b83ad1a5efcfd27b065fb9fb958d23ef2871f2c853cc65b938e824ad3e973b496b574
SSDEEP 196608:rNPU4UUU3UUUfqlu1tIDewjqkjiqMj/jTQP8I:Vqlu8Kweky/TRI
TLSH
T1C2A66BE9AEA4A0E1F9A79878B927867DFA737D100833430B89D3F61E6E335514D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4680	original_temp.exe
3876	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
3876	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_e7e2d9a990a9319ee4d5e2df137f88a3_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4680	2972	2026-06-27_e7e2d9a990a9319ee4d5e2df137f88a3_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar.exe	90
PID 4680 wrote to memory of 3876	4680	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-27_e7e2d9a990a9319ee4d5e2df137f88a3_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_e7e2d9a990a9319ee4d5e2df137f88a3_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.unelevated BurnPipe.{E1CFA6CE-CD21-437A-96CC-4B8E1ABAF7B6} {E27DE3AD-249C-4953-98BA-B66E57C64A4A} 4680
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 2.4MB
SHA256 8c0f3345310c8a4e2e893076d43977edf460fba237db419e997b928876890fcb
MD5 79dcee5dbafc97f569821a6f5fba5cf1
SHA1 e53869550e0cf3ece638ccfec989b4bd226999eb
SHA512 f6d212b42b58de75a651a2ccb94386b953528a915ccff32eefbecce84b4e3bc5c2718f87e4df3ecf2d8e603b4c4d21d14e40e67f82c8811c607a9cfcd30738d9
SSDEEP 49152:X6F0eMpAAYEhp6U4UUU3UUUfqPVUasqcJ:+0nAAYEp6U4UUU3UUUfqPVPFg
TLSH
T134C56DE1FF42B0B1E4B208F1360BE7FDEA236D244822C957F687FF287576551652A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC11C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXC11C.tmp
Size 1.9MB
SHA256 147a8c60ea637154f71112ddddc8a4a8305c542c654f72f93250e1a3e0361b5d
MD5 a6f1b0dc64e8ab052ae9611e8f58aa6a
SHA1 13058550ddff95054f52e14442319bed763fef66
SHA512 a2d0b1175d0074b75cea119ce45d6e613ccc827876e44ac47ede488ed3a5190e8ec6c9e90a953e9e177e2643212f8d5de28ef5685932f3c7c20b32ef8e27bd58
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO5U4UUU3UUUfqr7:X6F0eMpAAYEhpeU4UUU3UUUfqf
TLSH
T10A953AD5FF42B0F0E8A208F1360BF7FED6236D258822C957B687FB28B5776116519206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 455KB
SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
MD5 3284088a2d414d65e865004fdb641936
SHA1 7f3e9180d9025fc14c8a7868b763b0c3e7a900b4
SHA512 6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
SSDEEP 6144:9qIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi/6xLdowQguVC+:9qIOkU8AMXE9B7PElZlP41v6ro4n+
TLSH
T13BA45D31A6A04037D6F106B3F914D6307E7DA2187B1184ABD394AE2D7AB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 cdcce415f2a0e0328ba0e1913a1297ad3c659851b0f330ac96f0085ae7f7d9e3
MD5 0e8b2130a3f87971995d1242e67df4f9
SHA1 e36484f9d84618d61c7a82003a2797bfc3a1c2b4
SHA512 ca30b2aeef56ac4d3ed03b689bc1bb7bf65eaf0e776182d4bf4cb5c2a9fe2a5d0ac7acaf5c012751179d405bb6f8631bc3ed1c6808139d8a276b4f6f2bc661ee
SSDEEP 24576:87VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOU4UUU3UUUfqXV:f6F0eMpAAYEhpRU4UUU3UUUfql
TLSH
T175953AD5FF42B0F0E8A20CF1360BE7FED6236D258822C957B687FB28B5776116519206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 c38a318b88ddd941fc9c85b6af11a993f2fb4e4f515e954d114f7f20890def97
MD5 e25504f4e1372cf834791f425d8d6a17
SHA1 b78055e5447fb041c9ae6b621529d45c05291534
SHA512 d2b5867f1f637b72ddef87a575029e939caea0cfdca5b015e3b845ee58c5b1474a2d5711274ade979b55dd32691cbec0f397da312428463674bc1b52b2b78fb5
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODU4UUU3UUUfqPm:T6F0eMpAAYEhpkU4UUU3UUUfqO
TLSH
T152953AD5FF42B0F0E8A208F1360BF7FED6236D258822C957B687FB28B5776116519206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 5ab82b49a34c5fa25c8c995c11e37ea325b01e71690d6f1ba9466d0c0bcf820f
MD5 4983a056f04e69dbbe59453901777d99
SHA1 11bab4369af69b355b6692f03fe18796601d0c3f
SHA512 a126e60e7943526d75b1f69af3dc5c9b3f99abd84ee1e408b37ef510040591b03a274473d17c3d291d400003dc8157d9df636a5761982a2bd3bafc4f6ea4803b
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOZU4UUU3UUUfqrr:X6F0eMpAAYEhp6U4UUU3UUUfqP
TLSH
T1BF953AD5FF42B0F0E8A20CF1360BE7FED6236D258822C957B687FB28B5776116519206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2972-172-0x0000000000400000-0x00000000005FD000-memory.dmp

Download

memory/2972-183-0x0000000000400000-0x00000000005FD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads