e2e4c63b5222f64a378d7e3362f6e29254388f7d88faefd51963d595472877cb

General

Target
2026-07-21_00a03376836cd9a3603649351ec7387c_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 6.0MB
Sample260721-df4mvsey21
SHA256 e2e4c63b5222f64a378d7e3362f6e29254388f7d88faefd51963d595472877cb
MD5 00a03376836cd9a3603649351ec7387c
SHA1 2672a5c63b76602c8cf7b92ba3885b09dc0cfde2
SHA512 abd67f826225c8adcd22da96fef83906165b5dd0b0938eaa5db4e78ef16e109a637baba64bba3809fe5b4c809670f305a01bc6cc341b4ee19c6c82214372be01
SSDEEP 98304:u0nAAYEpShahOo8NN+bClr/fRpm1WqaJnqRInq:jNdhOo8NxHro/EqWnq
TLSH
T111566D52E36250B8D46BC8B0CE1D553296357C4A43F096FF26D4BAE52A72ED43B38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5836	original_temp.exe
5964	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chromium_installer.log	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_00a03376836cd9a3603649351ec7387c_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 5836	4640	2026-07-21_00a03376836cd9a3603649351ec7387c_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	86
PID 5836 wrote to memory of 5964	5836	original_temp.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-21_00a03376836cd9a3603649351ec7387c_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_00a03376836cd9a3603649351ec7387c_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    C:\Users\Admin\AppData\Local\Temp\original_temp.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Chromium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=133.0.6928.0 --initial-client-data=0x25c,0x260,0x264,0x218,0x268,0x7ff786ddfce8,0x7ff786ddfcf8,0x7ff786ddfd08
    3⤵
    - Executes dropped EXE
    PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 634dbc6fd6a9a6678199e8daefd4c26ed9f520cd83b34083b46686bf8951eed4
MD5 0da8e7158ca649e02738354ba5f5e5f9
SHA1 7c8b7655ac42c63f0bfd3f6c59739f769b28ebf4
SHA512 d73654ce37d68e39f3dc6c3610737615ee20492039dac653378db6594e05f1b1a4a46eee951ebf9933cde47cb319180905c4ccc6474e00f38668ec7a372679f0
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9IYA+wxr83npi63iY:76F0eMpAAYEhpAhwR8XpiM9
TLSH
T18F756C50F7C7C0B1F97316B0496BE7B65530BD228431C92BE7C8EE09B9B2A51A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4CD.tmp
Size 1.2MB
SHA256 d86ce5d83fcc61f5433715a0d73eae55f43776b76c99b67fd44367482888b639
MD5 cda4b53aa21c2039be2613e9be6fed04
SHA1 a7299ce5f8b91ba35da507e941071eba248b6276
SHA512 c4f9a32a3e973e15ac0422a96a7e47937515145dcf5e01bd72f12a9322348dc706def52483b1ccd17b13c964b54881b87af50d30c356afef404174341fabf20e
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrIYA+wrb:H6F0eMpAAYEhpShwn
TLSH
T16E456C54E743C4F5ED2710F1444BE7FBA5309E2A80319D27FBC8FE01BAB2E52652A616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7AE.tmp
Size 1.2MB
SHA256 53d0150081f62d1a19466c363943b26acb2f889bd73fb1618208654f8291015a
MD5 2c98b0d9db78f7728c3eec16f12d1dd2
SHA1 6a9d5c8e9ef754b7558793d7a8a6b3c466dec13e
SHA512 ba474cfff7988a47e91a2714057db026d8d3541126cec178b1b7b047691b5a21c488dc752151f1bd932a0156b6b8cbe82f11d23091a55b42da7d1ae3a5fad386
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQIYA+w2X:76F0eMpAAYEhpdhw0
TLSH
T1DD456C54E783C4F5ED2710F1444BE7FB65309E2A80319D27FBC8FE01BAB2E52652A616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7AF.tmp
Size 1.2MB
SHA256 da1bf219e96366b22eea5c70e8feb6e9e342534965f010f0979ea44266b22093
MD5 13dbf3551f10d5456b5a4793cffde043
SHA1 0281cfa990198856d3c0c2f0253ed988c257a420
SHA512 c98af2fb27afad7c50f5e0958ca7d747e88c2f1241024606aadf365d8eb9152379ff3343122970f12251cd1b1692d2ebb8f58c263b6d9c8bf3f4e96db0569d17
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOKIYA+wrz:D6F0eMpAAYEhpjhwf
TLSH
T100456C54E743C4F5ED2310F1444BE7FBA5309E2A80319D67FBC8FE01BAB2E52652A616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 4.8MB
SHA256 b8cbbdaab265e6ea58fe0331152797e03bca5c284aa8a11556e6ea68e6340c6d
MD5 b06dc4e909f0dd18ab77dc8b4de38491
SHA1 e848db5948d68384dc4de38fe50e35b34de47f93
SHA512 e753337b902913aa8643c700dd2de3080e1d1e39cd89c43b47074f1408b1ecf75689736f884855f4fc84041c604f5c5abb1796df0cd51ea849486fd77700d37e
SSDEEP 49152:VOmfr/quPy22RBnNOPrF2S5Jz37TulYYM9wfI8padEYWnkXhY2Vsm0C9+qRIpJrL:VOo8NN+bClr/fRpm1WqaJnqRIn
TLSH
T169365B53A36610B8D46FC9B4CF29552296253C8A07F496FF22D47AF51A32ED43B38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4640-286-0x0000000000400000-0x0000000000536000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads