Overview

overview

10

Static

static

10

2026-07-08...at.exe

windows10-2004-x64

10

2026-07-08...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 20:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
  • Size 746KB
  • Sample260708-y6vg4ahv21
  • SHA256 d438b08e52f5cc79cedda248f8d918b494a37c31cd12647afc9cc543fa61bf3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectioncredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.ozokcys.com
  • Port

    587
  • Username

    [email protected]
  • Password

    g]R?.4vbqPKJ

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Uses browser remote debugging 2 TTPs 2 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
      "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3132
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
        3⤵
        • Uses browser remote debugging
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:6076
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome6076240731875 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome6076240731875\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome6076240731875 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x210,0x214,0x218,0x1f0,0x21c,0x7ffe3efec728,0x7ffe3efec734,0x7ffe3efec740
          4⤵
            PID:6016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
          3⤵
          • Uses browser remote debugging
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4580240732250 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4580240732250\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x300,0x304,0x308,0x2fc,0x360,0x7ffe3ebcc188,0x7ffe3ebcc194,0x7ffe3ebcc1a0
            4⤵
              PID:1352
        • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
          "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2268
        • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
          "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1112
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:1524
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:1912
          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
            1⤵
              PID:5924
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3840
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:3156
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:5972
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3976

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Modify Authentication Process

                  1
                  T1556

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Defense Evasion

                  Modify Authentication Process

                  1
                  T1556

                  Modify Registry

                  2
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Modify Authentication Process

                  1
                  T1556

                  Steal Web Session Cookie

                  1
                  T1539

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  5
                  T1012

                  System Information Discovery

                  4
                  T1082

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Email Collection

                  1
                  T1114

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 595B
                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ChromeData.json
                  • Path C:\Users\Admin\AppData\Local\Temp\ChromeData.json
                  • Size 322B
                  • SHA256 7fac88b022b20b7512d7e6b4ec4cc4994895f21cf5869d4e212a017d6032acdc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DllExtractChromiumSecrets.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\DllExtractChromiumSecrets.dll
                  • Size 45KB
                  • SHA256 b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DumpBrowserSecrets.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
                  • Size 381KB
                  • SHA256 c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  EdgeData.json
                  • Path C:\Users\Admin\AppData\Local\Temp\EdgeData.json
                  • Size 429B
                  • SHA256 d4a5e0b6161e2bc617f81fc2362d49b216ff4f2f6aec59f9921d10c3c01dee4b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4580240732250\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 47cc9cc81a384a3acf95a13a9d5f736f1f8306116b59b7d8c5f69d639007b03c
                  • MD5 SHA1 SHA512
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4580240732250\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/2612-30-0x0000000002F10000-0x0000000002F86000-memory.dmp
                  Download

                  memory/2612-2-0x00007FFE43840000-0x00007FFE441E4000-memory.dmp
                  Download

                  memory/2612-0-0x0000000000980000-0x0000000000A40000-memory.dmp
                  Download

                  memory/2612-28-0x000000001C5C0000-0x000000001CAE8000-memory.dmp
                  Download

                  memory/2612-4-0x00007FFE43840000-0x00007FFE441E4000-memory.dmp
                  Download

                  memory/2612-3-0x00007FFE43840000-0x00007FFE441E4000-memory.dmp
                  Download

                  memory/2612-34-0x00007FFE43840000-0x00007FFE441E4000-memory.dmp
                  Download

                  memory/2612-26-0x000000001BEC0000-0x000000001C082000-memory.dmp
                  Download

                  memory/2612-1-0x00007FFE439CF000-0x00007FFE439D0000-memory.dmp
                  Download

                  memory/5972-99-0x000001FC1D5C0000-0x000001FC1D5E0000-memory.dmp
                  Download

                  memory/5972-85-0x000001FC0CFB0000-0x000001FC0CFD0000-memory.dmp
                  Download

                  memory/5972-43-0x000001FC09510000-0x000001FC09610000-memory.dmp
                  Download

                  memory/5972-45-0x000001FC09510000-0x000001FC09610000-memory.dmp
                  Download

                  memory/5972-67-0x000001FC1D220000-0x000001FC1D320000-memory.dmp
                  Download

                  memory/5972-65-0x000001FC0CC50000-0x000001FC0CC70000-memory.dmp
                  Download