Overview

overview

10

Static

static

10

2026-07-08...at.exe

windows10-2004-x64

10

2026-07-08...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/07/2026, 20:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
  • Size 746KB
  • Sample260708-y6vg4ahv21
  • SHA256 d438b08e52f5cc79cedda248f8d918b494a37c31cd12647afc9cc543fa61bf3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.ozokcys.com
  • Port

    587
  • Username

    [email protected]
  • Password

    g]R?.4vbqPKJ

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
  • Uses browser remote debugging 2 TTPs 2 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
      "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
        3⤵
        • Uses browser remote debugging
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4472240671187 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4472240671187\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4472240671187 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1d4,0x1d8,0x1dc,0x1b0,0x1e0,0x7ffef2a0c728,0x7ffef2a0c734,0x7ffef2a0c740
          4⤵
            PID:1692
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
          3⤵
          • Uses browser remote debugging
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1228
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1228240671500 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1228240671500\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x310,0x314,0x318,0x30c,0x328,0x7ffef264c188,0x7ffef264c194,0x7ffef264c1a0
            4⤵
              PID:2292
        • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
          "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4644
        • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
          "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2392
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:2420
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:1028
          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
            1⤵
              PID:2148

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  ChromeData.json
                  • Path C:\Users\Admin\AppData\Local\Temp\ChromeData.json
                  • Size 677B
                  • SHA256 2206a84742370b14ba95056ed50024043ddb6acb02a1f2134effbdada7d38da4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DllExtractChromiumSecrets.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\DllExtractChromiumSecrets.dll
                  • Size 45KB
                  • SHA256 b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DumpBrowserSecrets.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
                  • Size 381KB
                  • SHA256 c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  EdgeData.json
                  • Path C:\Users\Admin\AppData\Local\Temp\EdgeData.json
                  • Size 258B
                  • SHA256 df5efa0b727907442f04a616425a1760623f13ec286fa0916ad290a2b82cff33
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1228240671500\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 259723966a1aa76421766113831992cb17dae4cf860b38e10d4241536088462e
                  • MD5 SHA1 SHA512
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1228240671500\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/1952-0-0x0000000000F10000-0x0000000000FD0000-memory.dmp
                  Download

                  memory/1952-1-0x00000000017B0000-0x00000000017C0000-memory.dmp
                  Download

                  memory/1952-51-0x000000001C170000-0x000000001C332000-memory.dmp
                  Download

                  memory/1952-53-0x000000001C870000-0x000000001CD98000-memory.dmp
                  Download

                  memory/1952-55-0x000000001BFA0000-0x000000001C016000-memory.dmp
                  Download

                  memory/1952-59-0x00000000017B0000-0x00000000017C0000-memory.dmp
                  Download