74139fc3758211a52a5cbc8244addccecba1177d74bfe27850341a62a1b187e3

General

Target
2026-07-21_a2391a848e02e8c28e0e6f0f6f7bb960_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 4.1MB
Sample260721-cyynwsd17v
SHA256 74139fc3758211a52a5cbc8244addccecba1177d74bfe27850341a62a1b187e3
MD5 a2391a848e02e8c28e0e6f0f6f7bb960
SHA1 1b421a2eceffef44a2b0edb2f0554c13afe4e62a
SHA512 c2232220b74115972405898f92f5a51bac796acc378f25431ddaf6da1fa71a562a531ffe87f7ce9da3cdd777bb504fef1926d667912fd84eab328127b0631c47
SSDEEP 49152:D6F0eMpAAYEhpqhwh6HlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw+:y0nAAYEpqhE629jht3zpfuOHUj
TLSH
T1A6167B56F28680F8D42AD0B0860AE672E5307C494721A9EB57D4FF253E73FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5872	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_a2391a848e02e8c28e0e6f0f6f7bb960_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-21_a2391a848e02e8c28e0e6f0f6f7bb960_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_a2391a848e02e8c28e0e6f0f6f7bb960_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5432
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4976.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4976.tmp
Size 1.2MB
SHA256 7e3db334b234e19bdf2036824c550f3bdbd3a5dd78530bb492f0ef0660d3f684
MD5 cfa3e8641648286b55df5344904e382f
SHA1 33e13c42b0d5b2987f5cfae501d63f12e7443bf8
SHA512 fee9f4899de584b75a60e0284f93a1b932e84be32e6f65e6907e6fe59af3678a956e8eb7c477f842a105807b4eed48cfda1f879b9f01fef3307f9a6efdc7159c
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVIYA+wel:/6F0eMpAAYEhp8hwW
TLSH
T1F6456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.9MB
SHA256 3d60f4ac797bbaba526aec448e3b6399843a94cb1fb95ce256c8d14ad770a84d
MD5 b6ab38ce565b04bfbb9064be9f3b3872
SHA1 a52e2882b21927bea4238a4ee43805506c3df9c5
SHA512 cf2ad3e8467226f0e27c35990d093bc19bf3cdd7b7f634ba9ae61daf66aa4d101a34af97c4dfe3e7e48a1d6612f09e4436429fa056efd719909ae4592f4b8ccf
SSDEEP 49152:uHlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw:u29jht3zpfuOHU
TLSH
T1B3E56B13F29A50E8D05AD0B8C74A9631F9717C850B2069EF0394FB252E77BE46F3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 683b8a33a2b5082f936a1cbcebdd72b14ef77b5f283858448d47df581fef9803
MD5 50b4def4241ec605dce30683bbe38301
SHA1 b334c2f952bb7c6f27c08178880e2a85a6539762
SHA512 e193582e6ef1fac1ca44c5af85659e876bc60f6452f99cd309e3f93942c16857f5bd8561d4a59e48f83b3495af3185cdf91c5726a964e8d5da3921cff7d96690
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO7IYA+wPJ:D6F0eMpAAYEhpqhwh
TLSH
T1CC456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 8ad5fadb550722329f18cfac948cff9d75ae9107c41585a0e792cb971a97a061
MD5 c209ef60407e5e7dcd95a04e6257627a
SHA1 a3449ac6c61e1f033762521c50b308ce5be931c9
SHA512 052faa09f931c8f04f3e5f55dd6afd6e45319187428231055ab3cc25f7f51b381ca09c4c4d998908d86cfb9f38c8d7e407dfe02e53d97ab2a0f47850d9ec26dd
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBIYA+wWL:j6F0eMpAAYEhpkhw0
TLSH
T1E5456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 b4110c4b63951040a06be391b1c1620caefd0a0a2c0d2a20fc319f3c90c98c04
MD5 a5b96d79fdcbc43744596a80baa5ba6c
SHA1 c8b370751010e10b0738f1de6383b99168968485
SHA512 da349d04bd704107b93883b69ec887693b80705bbe64e6ff045c99b8622baf5f6663e2b6bb2c820bd9ef55f6045a0eb5a1f528236b327f2aadeb3d4dcbe2a553
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6IYA+wl9:36F0eMpAAYEhpHhwH
TLSH
T15E456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 4d5499221d3282339a1ad30b7105a7fe3fee75669f77f4307dd10ec21e3e099c
MD5 a7d18f50635d07104fd045cdd754e479
SHA1 4dcae67d6ee81a7efa167b2d62b56f7ab28fb2c4
SHA512 4bb5814f8d23fb24edba85055400bc697e16fb3b30a3503d9caa7e5975e06f57ccd050b8ac0595d97759707e1222bdefed50d1bd9a7ff0eb5f74d20742ad00b2
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3IYA+we9:X6F0eMpAAYEhpqhwO
TLSH
T1B6456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5432-151-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads