eb1d6671d9848b2260546da343be0163bf498b785fb0cda9ce68acd562bb5d5d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_0c74a04a0a4a4728735a114e764d7305_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 5.1MB
Sample260806-cvtwjafd49
SHA256 eb1d6671d9848b2260546da343be0163bf498b785fb0cda9ce68acd562bb5d5d
MD5 0c74a04a0a4a4728735a114e764d7305
SHA1 aab6f5615bde7c0c22ec367198d47ba36f5dc6cf
SHA512 2d3517d73e474d73d2229e6eeb71da5f4c540ff33170465a525c2d57ea58fcac1820a95d21c050616c5a3e45ac40109b34e10ed46543b13496ed882ec6218d3b
SSDEEP 98304:G0nAAYEpgU4UUU3UUUhhW9/fh6ImzzJoDfuBcMv+A73XA+:rN2U4UUU3UUUa9Hh6ImzD+F+
TLSH
T1BA467C50FACB94F5EA0315704497E3BF6330AA098335CAD3DA84DF56F963AD21A37216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3960	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_0c74a04a0a4a4728735a114e764d7305_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3960	4092	2026-08-05_0c74a04a0a4a4728735a114e764d7305_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-05_0c74a04a0a4a4728735a114e764d7305_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_0c74a04a0a4a4728735a114e764d7305_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXECA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXECA1.tmp
Size 1.2MB
SHA256 fb4630d5636ae06b39a83783594ad3d57e360fcdc106d1a6fd160c4abc21edaa
MD5 9a52c8fc70d7a75d7139b751b2bcd745
SHA1 935b726577f4637bd1de55d05fc0a6bd0a3c5fed
SHA512 9adfbc533078d1ef3958483a993ed6fb697f77a37455cb847c81551c14b533c5f9142b8498e0f55db72b0d2874be7eceaa083ae298d0d044cccfb31da2131e9e
SSDEEP 24576:y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrU4UUU3UUUm1YA+w/1:h6F0eMpAAYEhpAU4UUU3UUUhhw9
TLSH
T142456D54E787C4F5ED2314F0444BE7FBA5309E2980328D67FBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 3.9MB
SHA256 7ab635bfad8f5e753bb3fe894743f9fab9352d0a93686b2cb430ddd0784262c2
MD5 9663ce631822cdc1901ec62ac04ef9b5
SHA1 38c52598624ff74c9e656a504edb5a5bd677adf9
SHA512 42d3164cd36cdb36a85daab8d873ea93b43e7eac3ca34045f9f4630884278d3e77bb85deb9903ef19a94d5aeed0c459809d60df4a8c77100a9556ab3cea5b43d
SSDEEP 49152:JKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gjg+A2deCMmwV/vJu2mWG2mrk:J/fh6ImzzJoDfuBcMv+A73XA
TLSH
T153166B51FEDB94F5EA035A3045A7A37F6330A6098335CBC3CA405FA6F957AD21A33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 4cec66fc7c79fd1bab1946b0f825c4db1efc905183035f00763e5a6ccb6debdf
MD5 76860c5ea4bca9b9190b5d74371d2942
SHA1 431dbac17a90f870d6f1f050574a117e938565f1
SHA512 02153b4c9b9421c1472dbf988bdcb581d2537349c95215248e6331268c497d630642b8b79533cc11678ec60e11e45fd8d9f0becb62a84ea67f593214f03ef8bc
SSDEEP 24576:87VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHU4UUU3UUUm1YA+wfn:f6F0eMpAAYEhpgU4UUU3UUUhhwP
TLSH
T1F4456D54E787C4F5ED2314F0444BE7FBA5309E2980328D67FBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 c7190b9d351b50b95425fee1de574ab61e654290609a5ab3be7ccf49bc7eb886
MD5 c7f4439d38b58f55aa1b1e8e743a3a22
SHA1 71d83ddcfdc9370714dc4502b47e768d9c2f0d06
SHA512 cc3a45aab764a6d1d0cca230b671a7f9263c8e9d0d57cd6de0a3c4c9d1c9cc420173a55d2bb8526379149fb15a88eeb7ae1d6de45bfb53f4dad2ceec8dc5006d
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtU4UUU3UUUm1YA+wif:/6F0eMpAAYEhpCU4UUU3UUUhhwo
TLSH
T13D456D54E787C4F5ED2314F0444BE7FBA5309E2980328D67FBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 a2ef4b50f98c151cbcf77e89a1a89b2941af14726c1d7f96b0e0753aa97af0d2
MD5 cb7be29dbeba93c08d574c3eb367db6b
SHA1 9b9da4adea518bca8540e36675096066231053f0
SHA512 323d99ded25493c972af5cfc51ee0b2d12350df5cdc34f229469dd9c25f6ef483959e24063c1f3e9ae2af8a280a3fd49e153bc593fe7046df9183e690dc2e289
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOFU4UUU3UUUm1YA+wL0:j6F0eMpAAYEhpuU4UUU3UUUhhwg
TLSH
T1FC456D54E787C4F5ED2314F0444BE7FBA5309E2980328D67FBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 3f8a63fa8384f382601946634ceef602d2e9b3d6419a25aec5b578a1da12e8e3
MD5 cd7e56e766613e5eff90a79a7094d3af
SHA1 ed452e23cfdcda14510e207bd54a7d6b26c9ebae
SHA512 212c462b5a0ce379726d8eb8450981a5f8077ac73895918a9240749fb01666dbd0e3abcd76d93e8fd7c6393309c4e63f90b8ead72b524b50062ea4c83caa22ff
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO0U4UUU3UUUm1YA+w/l:r6F0eMpAAYEhp/U4UUU3UUUhhwt
TLSH
T17F456D54E787C4F5ED2314F0444BE7FBA5309E2980328D67FBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3960-160-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-154-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-158-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-162-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-167-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-171-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-175-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/3960-179-0x00000000009E0000-0x0000000000DEF000-memory.dmp

Download

memory/4092-153-0x0000000000400000-0x0000000000540000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads