489342d46f916aaf8952fe1e6cbe2889697c236fe6217b9852738cf3f55bf49e

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_bba93aa3ee5a3ae7508735cfcc7319d6_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 3.4MB
Sample260716-rb7evaez7n
SHA256 489342d46f916aaf8952fe1e6cbe2889697c236fe6217b9852738cf3f55bf49e
MD5 bba93aa3ee5a3ae7508735cfcc7319d6
SHA1 d7c0fe14c31657f78edeca7f69a11f14c656a358
SHA512 b7fe35cd10028199dd0ba324d0c324bb3a20fd2c446d54617d5a17e541c02c7edd44caf1551ba96d64091d5ce38bc011068e092d557b3901f521aa285a052c1b
SSDEEP 98304:n0nAAYEpVU4UUU3UUUjTquXYvi/rNQUs2:0NLU4UUU3UUUjTquXYks2
TLSH
T1A7F57ED6FE42B0F4D45784B0B50AA67EE5337C154F2199EB6783FB242E73AD05A39202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2700	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_bba93aa3ee5a3ae7508735cfcc7319d6_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 2700	5616	2026-07-16_bba93aa3ee5a3ae7508735cfcc7319d6_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-16_bba93aa3ee5a3ae7508735cfcc7319d6_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_bba93aa3ee5a3ae7508735cfcc7319d6_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.5MB
SHA256 7cc2c208f63f8371c0eeecd0a71210050fabc079b77c040a6d0b6041e215f1df
MD5 72b154404aa25049d106a3c7399bae42
SHA1 1b229af309f7c7201cae4d62c4f85f334ac41d9b
SHA512 4d7ba0f5da0df61407fa277590f86fa009d0e4370d1d75460e2c3cb469f77362375caf6633aa0c479f22de443b52b2636ce428d40f17be4eea60904dbda9c4da
SSDEEP 393216:nqYlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXh:nqEWO1c877xqpyovvVWJ6VFK+q3cSvXh
TLSH
T1306712D1BFD5B071F4A30A707A69A6BE85277C314B3281DB6283F71C16709D19A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB64.tmp
Size 1.9MB
SHA256 bf7db61b70d44702ec950ed07030ac59c4b72239496d8623be3abda05f4db8ca
MD5 5171154628344d1b147062e328c50b03
SHA1 2d471b6596b0307110d288d90805739083af5f73
SHA512 a1d67e84c8d0b7bcf89071b44c458ab6bc8865a0b2d8b4adae431b744a05f2bee9048fd2a9400b0751025563849ee7b95994e43b2316dce62e65f4ace4df0040
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuU4UUU3UUUjTq6P:s6F0eMpAAYEhpNU4UUU3UUUjTqg
TLSH
T1E7953AD5FE42B4F4E8930CF1350BF6FED5236D258C228AA7B687FB28B573A112519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 1.4MB
SHA256 9aa9bccd1e19e7deb89b511c9cbe3b7cf65fb7b91ca803c342acac019a805401
MD5 376e62f9aaf740b4f727bbf0982340e7
SHA1 6899614f53b733e587a2e3213d6bba4f769bc4f4
SHA512 27c9e8aad973aa7283a6409f19613b78a29542d3494a122f0fa49fda42afa64d4985fe0a13b208d100d14a040874ee1fcb0fe47b009b21477faeaf9785129964
SSDEEP 24576:CydvLvOvod0I7xCSllclrJJ8TNh5cFnFU+6q6wPoSUhEj3:D9LWvqR7xCSfc18NQUJqPw5
TLSH
T109657C17B29A40E8D06EC2B8C6555532FAB27C450B20BAEF0390B7251E77FE46F39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 227965af860ef5d4732209fff808de7a26d363dc106652689595489a9db034bf
MD5 22a4239ea96241ac963aecf1efe4a08f
SHA1 baeb5b61da7aa7a25552501c107e3e587172e591
SHA512 2bb59cea72e0e2ef76e9240355efb3784c76ed062aba613d4e8d3519a92c06367f77faf6a1d7b7e2d913279d83b5954e8dd6667a989eae4e5bc4e0246239152e
SSDEEP 24576:H7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+U4UUU3UUUjTqeB:M6F0eMpAAYEhpVU4UUU3UUUjTqu
TLSH
T199953AD5FE42B4F4E8930CF1350BF6FED5236D258C228AA7B687FB28B573A112519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 5d86f3b89913de3027f99a551ac0a4a94cd0cee340fc7267d85f6e071085d256
MD5 2dd7f036412c50eee0d6b64f51232710
SHA1 c84a22f1cc6f69b3c86ea46d9170c02e409be325
SHA512 4a90ad4b38a8678c88922574cc35e9b0ed5b6243e26db9f38ec1cca67dc8ccd8d1a3c10d7be9767b1c3c1d75877235f3372076e59c1647cc41fd3380e28b9ff9
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdU4UUU3UUUjTq6/:U6F0eMpAAYEhpiU4UUU3UUUjTqw
TLSH
T128953AD5FE42B4F4E8930CF1350BF6FED5236D258C228AA7B687FB28B573A112519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5616-151-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads