18645853f33f3083697a6f093d0e6763066854508fc16025de2dcdb7247cd5a7

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_e00dc4c3315221e71a911842e45b912b_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 5.1MB
Sample260718-a38csaex3t
SHA256 18645853f33f3083697a6f093d0e6763066854508fc16025de2dcdb7247cd5a7
MD5 e00dc4c3315221e71a911842e45b912b
SHA1 d41881c64c2c99f7c19040feeca4d1cc6dce9aa1
SHA512 05ce2772fcc8ca777e6d8bf1947809f73e42a7175ac80b2da27077bf2522df14cb368540747d4549c6e3718f3bf376f13412517b8cf36812a18f79cdedba442e
SSDEEP 98304:l0nAAYEp5U4UUU3UUU6hO9/fh6ImzzJoDfuBcMv+A73XAW:aNvU4UUU3UUU39Hh6ImzD+FW
TLSH
T172466C50FACB94F5EA0315704497E3BF6330AA098335CAD3DA84DF56F963AD21A37216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_e00dc4c3315221e71a911842e45b912b_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2160	1960	2026-07-18_e00dc4c3315221e71a911842e45b912b_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_e00dc4c3315221e71a911842e45b912b_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_e00dc4c3315221e71a911842e45b912b_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 96d617b727421f1e957be74696092f042d731888ef9210adefbfe875b1806cd7
MD5 64f285f8bc23a0ef6b9ef4e7af0bfc57
SHA1 7eb12dc3f3c40dc3e2af82a13c7b2c52643ba08b
SHA512 4598bcaede13452d56735172b550160d939f81bfaaa3d7a576a7bc1445da2a4a0856bc3689b3fa001e71b336f0dd103d4e437f7568b7b578908c8eb3233fd479
SSDEEP 49152:/6F0eMpAAYEhp/U4UUU3UUU6hw78XpiMy:m0nAAYEp/U4UUU3UUU6hOgpiF
TLSH
T142857C50F7C7C0B1F97316B0496BE7BA5530BD218431C92BE7C8EE09B9B1A51A539B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX66F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX66F2.tmp
Size 1.2MB
SHA256 d6e56f1d3d41eb8d618f55c22988340b77207e9f60ad1321aa25c877718783db
MD5 b274ff0fbb1d12f1f4ecc586838970c2
SHA1 de32683aba9ca59f5f7214dba54cc4ec2bc0ee1a
SHA512 259d1080e57e01baf9ea403c04eeec273473747e7148ec1bdcc741d632f903fd00b74e45f612346cd18bc5eabb23e0f404cf44192a7e1fb2f2067bb3bda452d6
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO2U4UUU3UUU0IYA+wyU:q6F0eMpAAYEhp5U4UUU3UUU6hw7
TLSH
T194456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6A12.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6A12.tmp
Size 1.2MB
SHA256 a29f6ac8f4e6ab02ff7272b0db81386e60f25af75d51b96fb3071baa7f78ce37
MD5 42f6b120cd011ab4ca3848bd5ff5af3b
SHA1 a16c4a3465f3d589033d4b699f91bd1c9fdefa9d
SHA512 9d955705070c96705e3af0b61b4bc80301ba693fcea9cdb286938d723401877d2b82261a87f2e9130e4e6e82a853f880376a27f7087503e103ff10aa53ba7935
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfU4UUU3UUU0IYA+wSC:66F0eMpAAYEhpUU4UUU3UUU6hwZ
TLSH
T1B5456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6A22.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6A22.tmp
Size 1.2MB
SHA256 006f14161699e33b6af868a8d5038f3afadfd6c92e4c47d352d50c50dcde4a30
MD5 caa065e1714319b1d206179736db3d0b
SHA1 4488c484dd4f225e843517cbbcc58bda46cd94de
SHA512 348ba6dda08422b3036988640390d0fd41365d1bca3058cb11e68a60ba9dbbcb991b2d69f365f9fef50ed074c5735da652b5488d1e286310ca708440163b86f3
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMU4UUU3UUU0IYA+wyc:+6F0eMpAAYEhpjU4UUU3UUU6hwD
TLSH
T165456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 3.9MB
SHA256 7ab635bfad8f5e753bb3fe894743f9fab9352d0a93686b2cb430ddd0784262c2
MD5 9663ce631822cdc1901ec62ac04ef9b5
SHA1 38c52598624ff74c9e656a504edb5a5bd677adf9
SHA512 42d3164cd36cdb36a85daab8d873ea93b43e7eac3ca34045f9f4630884278d3e77bb85deb9903ef19a94d5aeed0c459809d60df4a8c77100a9556ab3cea5b43d
SSDEEP 49152:JKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gjg+A2deCMmwV/vJu2mWG2mrk:J/fh6ImzzJoDfuBcMv+A73XA
TLSH
T153166B51FEDB94F5EA035A3045A7A37F6330A6098335CBC3CA405FA6F957AD21A33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-281-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/2160-282-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

memory/2160-286-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

memory/2160-290-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

memory/2160-295-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

memory/2160-299-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

memory/2160-303-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

memory/2160-307-0x0000000000940000-0x0000000000D4F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads