72f8b5ce6e30573738dda61dd2a98beb7513f1793b064a95cc0d423aeb9272b5

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 4.1MB
Sample260803-c9186a1thy
SHA256 72f8b5ce6e30573738dda61dd2a98beb7513f1793b064a95cc0d423aeb9272b5
MD5 3cf8dceb488f55f777d18fa64adae70b
SHA1 4abda7db9f5a68b8cdaed14740f40291a2e1f52f
SHA512 03a908aa7fc49ff7effed7b848f6d9d6c8c84ba67dbaa9173a08e22446b4f828b29dfd88d5827ceeaaada910d507080e94a2b94d66a53296002cf93ebd6905eb
SSDEEP 49152:z6F0eMpAAYEhpdhwt6HlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw6:i0nAAYEpdhU629jht3zpfuOHUn
TLSH
T161167B56F28680F8D42AD0B0860AE672E5307C494731A9EB57D4FF253E73BE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4500	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2996
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6A6D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6A6D.tmp
Size 1.2MB
SHA256 e3e30f792ba17cf491f3f9871dc3f6c996625d14fd6fbc1e76d931b6a4afe939
MD5 da3a60b8cd06b03ca0f10581deb76e75
SHA1 a9b636c5d84383b4de5ce4bb8bd7825b11eaecd8
SHA512 26f0b0b62616b273d2454995a20169df9ac449c169667e3a9d6cdd70b64ed46f687262b3a065da1d863f799b3c8455a92c063d2db3aa6c14953b930c688649f7
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8IYA+wem:z6F0eMpAAYEhpdhwt
TLSH
T1B4456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6D00.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6D00.tmp
Size 1.2MB
SHA256 ca4c42f20db41bc8d6c7b0477fa4c6da808fef48af6aec1af4cb65f8a2acf58f
MD5 fa507e9aaa3daa1f595f1353d883aa0d
SHA1 0d9e7445494f683dd44a24c716a29f1e04c6ee16
SHA512 ffcd1890eea6c7a1afea0c7f5fbd6b6b6e77d0a320c11c67f2304a8c1c33c29a9cad7238d62d7870d91c650a61a93b821add9462424b8890d7f6c1fd57d22eb2
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3IYA+w7C:H6F0eMpAAYEhpKhw+
TLSH
T14D456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6D01.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6D01.tmp
Size 1.2MB
SHA256 bbbca087088ae20530cbb1a3c66fe00c396ca37c32ab93322d5f3e97814d5acc
MD5 e672063028f8924ed4fa9091421f3e4c
SHA1 94c8a7f7eb3789cb4bffccc508b13d596619da29
SHA512 b87e8afb5b4bf64bc7e1cd5e2eca53d0a53549be8b786cbadc4dbbb85fe92fe5133917564948e8159563d3368cea141f67f7a20d7719eb7e5487cf87ee1a0760
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMIYA+wee:P6F0eMpAAYEhp9hwF
TLSH
T199456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.9MB
SHA256 3d60f4ac797bbaba526aec448e3b6399843a94cb1fb95ce256c8d14ad770a84d
MD5 b6ab38ce565b04bfbb9064be9f3b3872
SHA1 a52e2882b21927bea4238a4ee43805506c3df9c5
SHA512 cf2ad3e8467226f0e27c35990d093bc19bf3cdd7b7f634ba9ae61daf66aa4d101a34af97c4dfe3e7e48a1d6612f09e4436429fa056efd719909ae4592f4b8ccf
SSDEEP 49152:uHlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw:u29jht3zpfuOHU
TLSH
T1B3E56B13F29A50E8D05AD0B8C74A9631F9717C850B2069EF0394FB252E77BE46F3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2996-294-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads