5588a89ac1c988ddabc5ae7cd44a696dc937bf7c03dfc6e78ff9edf16daaca0c

General

Target
2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 6.0MB
Sample260718-grxv8sdt21
SHA256 5588a89ac1c988ddabc5ae7cd44a696dc937bf7c03dfc6e78ff9edf16daaca0c
MD5 e1ba117a425a68ce0ca8536ea5ac6e11
SHA1 d2a519393b2ae0f0a93554e354e273ab349b0f88
SHA512 30d9ef0b22ad0c1f0900a268c84ad2b6db84453741aa375820836f937d72078049c28edba12f88b00c99d8a7f1c9cf503ac66dd18dcb48561ff44f79b1d3cc98
SSDEEP 98304:g0nAAYEpFhPhOo8NN+bClr/fRpm1WqaJnqRIn8:dN9hOo8NxHro/EqWn8
TLSH
T13E566D52E36250B8E45BC8B0CA1E553296357C4A43F096FF26D4BAF52A72ED43B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1224	original_temp.exe
1152	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chromium_installer.log	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 1224	6012	2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	89
PID 1224 wrote to memory of 1152	1224	original_temp.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    C:\Users\Admin\AppData\Local\Temp\original_temp.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Chromium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=133.0.6928.0 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff7effdfce8,0x7ff7effdfcf8,0x7ff7effdfd08
    3⤵
    - Executes dropped EXE
    PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXE25B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXE25B.tmp
Size 1.1MB
SHA256 5407b28316bc19cb8003844f5840701d0f26f129d56400153fcce5a8615cd79a
MD5 cf8f792d9f2e8e5158d298aa646e3985
SHA1 457672d072465197cc938096f953caf7c130fafa
SHA512 c46dd06bb04e0f4ad22a056b4c67bdba445375e5492c09bc621da40347dabe0b398fd58f4d3ce0dd4fb2d4d90792d925dbd38d0654ce5630430029e65dfc9d05
SSDEEP 24576:67VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdwYA+wMn:p6F0eMpAAYEhpEhhw+
TLSH
T1D4455C54E783C4F5FD2314F1444BEBFBA5309E1980318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 4.8MB
SHA256 b8cbbdaab265e6ea58fe0331152797e03bca5c284aa8a11556e6ea68e6340c6d
MD5 b06dc4e909f0dd18ab77dc8b4de38491
SHA1 e848db5948d68384dc4de38fe50e35b34de47f93
SHA512 e753337b902913aa8643c700dd2de3080e1d1e39cd89c43b47074f1408b1ecf75689736f884855f4fc84041c604f5c5abb1796df0cd51ea849486fd77700d37e
SSDEEP 49152:VOmfr/quPy22RBnNOPrF2S5Jz37TulYYM9wfI8padEYWnkXhY2Vsm0C9+qRIpJrL:VOo8NN+bClr/fRpm1WqaJnqRIn
TLSH
T169365B53A36610B8D46FC9B4CF29552296253C8A07F496FF22D47AF51A32ED43B38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 aa6fc38f5f12e86225891ad5e1ab9622ea42ef268ab7187a3c693252d2edf320
MD5 6d86b91c87e638ecfb66a7d72c1f3cdb
SHA1 fb6a3676d59f24fb4764d4ea9a11078e5e11867f
SHA512 f746d2fe75f309381b1562c09b548599fa474d5f67b2c4c96d13f2c15703c22a3ce4a96ded1acd26145bfe0f02609799ef48d7336a84754c4c10e16831b24d31
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6wYA+wix:x6F0eMpAAYEhprhhwK
TLSH
T190455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5e7d12b80809a186967f9b76977cbaeed90982b373f49ed3fb1c16bf0ef2a3b4
MD5 63d2ad83e01870481fb6b6736b3b1a9e
SHA1 44f2bd22b39bd69e93266418d6134a3c99e2de64
SHA512 f65a00b08a432f510e2cea62689625c94a36944ec907aa1d77e01bb8fdab201b633da960fb14ca1f9e8d69eacc73595735cadebd0489c4764349d14e96eec710
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEwYA+wxl:x6F0eMpAAYEhpthhwz
TLSH
T119455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 1fd4e0510f113c182d441f2f476e7e86751119bb2a2be720a2ae82ed2e435cf9
MD5 f20f1dd236c6653423480f536eb67f7f
SHA1 c07d452728f10353939ec6be3f5e871f2e486506
SHA512 4bfb0054d787d32af0d6c9eda77c1736d7f549aee48c4a9b7aa3943f051e13678353709357734f887fab78b87179fcec1697dea7c630178c5f6105bf6a510423
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIwYA+wMv:x6F0eMpAAYEhphhhwm
TLSH
T171455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 972960de3886ec9c0056903e428d1d354a690d79cfd6476279b2e55cdc5f3773
MD5 8f977eff17ea2e8adfeaa74f4403314e
SHA1 c96299ad08516cb0ad3d3820da8fe0763b34ef4d
SHA512 c42e936c6769b30a6c1739f61e5eeab4aac0f61391a2da4bfddd2483ca99c5ad8786058a6122b5ffc775f73ad931f53500a853cc4a54cf8f5791fd16b9ebfd4e
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpwYA+w2Y:96F0eMpAAYEhpIhhwf
TLSH
T1C5455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 ded1768412d1004ac4e5845c9f6837db0eebe890d9bc749f3063e07a79005bcd
MD5 2ba4122c74c209a8c172f6c6b9fd64d3
SHA1 870a619e17b1146f07cedfe9cc0241313a370901
SHA512 b6af8de82cc04822fef33cf91045f8099c934c6be31a4f25f87f2af5ac2cd7d88c43e50eb910ba6ef9aaa45db8a1d0895cf07a9fa38e2400885a35bcaf8e4767
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTwYA+wQF:N6F0eMpAAYEhpChhwY
TLSH
T107455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6012-157-0x0000000000400000-0x0000000000532000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads