4b0a0ce608471751fdd5ad949a80a5075c4e3568cb4aaae5a183b1d9ff307c3f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_9ad6d41a3c230b451de9884484102035_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample260806-qdbkhsaa24
SHA256 4b0a0ce608471751fdd5ad949a80a5075c4e3568cb4aaae5a183b1d9ff307c3f
MD5 9ad6d41a3c230b451de9884484102035
SHA1 d269ec091326047db461852724ed37017cc6712b
SHA512 54f20a756e139e736de9d3a5fdd72b7e550f6d354f5989586f877665f0b8b4988801447e0d064c0ac01426b7fc2b995152ae65a09bb85246c842b80b82765593
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuYA+wVQK+woe0xEzeg:O6F0eMpAAYEhpUhwKrjiz1
TLSH
T179656C54E78788F5E92310F0444BE7FBA530AE294031CD6BEBC8EF15BE73A522529716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5896	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_9ad6d41a3c230b451de9884484102035_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 5896	4572	2026-08-06_9ad6d41a3c230b451de9884484102035_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_9ad6d41a3c230b451de9884484102035_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_9ad6d41a3c230b451de9884484102035_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4D00.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4D00.tmp
Size 1.1MB
SHA256 f054e2c3e5da64f50e3a43f1fe948d46da981c3835874316a9b134856519125f
MD5 c0a813c7f728e68e0bb689556ec43893
SHA1 189900c4a3bcfaea6b8396a6b222e3c83498e959
SHA512 46243c0122780d097567091ad36739b98fe4dce65a7a5f2d5f7bc873649483b90fe52606703f7b38671724fab7c56906d171a264a51efac2afd61366725bcb4c
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+wYY:e6F0eMpAAYEhp+hwV
TLSH
T1CA455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 263KB
SHA256 2bf2bd5d64208614144ed8628d9260f7c1abe23aa33cbcfe054b9fd68799752b
MD5 dfac0ee865997f50739fdb5426759695
SHA1 2a898d9643956ba55971e9d467bc0cdc576a05b3
SHA512 d7228f0fe82195bddf16d1e112673f58c550487ab9b767a22afafb455e6af35e78068cb5f048276a0e644b7ebe54000003f4f6df7dd76293ff25a198de63c037
SSDEEP 3072:MmYBmSN9w3Nw/Xf2w/cX30LFL5FiVop+xH02y8YQaH0Bv3ARKTeyr1Ez732JQDS8:Mx4SN9w3N7wo3Ol5FixxH7Y1z4SPK4
TLSH
T188446C59B3A40CF5F9679279C8458606EAB27C5A0760DBCF03F0869AAF233E09D3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 ee232639e2f08dc82726ac9f7127886bbe42109744c54fb5b51de8f0ef18e24b
MD5 ba793aff0fcb092140a3915ca376e7c4
SHA1 30b2f1150afc267b9f665223249794d26ab8e0f2
SHA512 c0ff2645ea6461d554bf91bed511cc03334d7af56bf9eea23cfb21b79cf0ee5cfbd3fa9d0e940045c2d42dbe67c1be3917d6db001441dd2aed1393177d0e347d
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuYA+wVQ:O6F0eMpAAYEhpUhwK
TLSH
T1E4455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 94f80f6ffcfde088ba3fa72e19685f7c2be0083b34ab959eba8ed365200ad666
MD5 42cb0b3360e6c2067f410d59f9af2256
SHA1 b19955b07fca9a32592b1244dd4d824b80b9fa59
SHA512 6d9515f30734043504dcf1aca39c3e689f3ff7df9d23fcafd7fb2870be3de902b725293adf70fb27fc7ef907e2df4c7b76fab71e9d8f9df6b750b3d1555fc0bf
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+wNB:+6F0eMpAAYEhpihw7
TLSH
T12B455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4572-151-0x0000000000400000-0x000000000052C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads