bcfc8a2d48955282c3ea2739fe0e19a440731d28ff63f085338c886b216dc25f

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_ecda09d032c107ece456067b5efbbcd1_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample260807-m5wszstcle
SHA256 bcfc8a2d48955282c3ea2739fe0e19a440731d28ff63f085338c886b216dc25f
MD5 ecda09d032c107ece456067b5efbbcd1
SHA1 8595d3d56751d1cdccba786c03c2337052e8b399
SHA512 7fa6607bfeb8779d44b4fd1fd447fe1388f15b5f119c5737a42b1e7e2e9f4c4b7246e1cf588b282740c8ce9ab498aca64fbfb5b331ab6f016c7c2f22f6c4d5ac
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxPYA+w6NK+woe0xEzel:a6F0eMpAAYEhp2AhwKrjizE
TLSH
T1E4657D54E78388F5E92700F0444BE7FBA530AE154431CEABEBC8EF15BE73A522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4640	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_ecda09d032c107ece456067b5efbbcd1_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4640	908	2026-08-07_ecda09d032c107ece456067b5efbbcd1_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_ecda09d032c107ece456067b5efbbcd1_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ecda09d032c107ece456067b5efbbcd1_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 9ddeb454802bac24ce9b9afb10c1f7bf22ad109f9551751361061f42503a8da1
MD5 e86a37a2cbc184717d298c6ed88c42a6
SHA1 97d238fcd33f1d78b0f1abe0cd6b9c6acbdcb7fd
SHA512 15866eb64f2921ec8dc316fa73fdeef985f7375e5a1aff4f2e1f47438ee79cb00462a4857bd0b37d2808414a941c24669c2a865747d5510fc7c7affec3bff658
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOJPYA+w8d83npi63iq:m6F0eMpAAYEhpyAhwQ8XpiMj
TLSH
T1BF756B10F7C7C4B1F97306B0486BE7B65531BD218831CA6BE7C4EE09B9B2A51A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 263KB
SHA256 2bf2bd5d64208614144ed8628d9260f7c1abe23aa33cbcfe054b9fd68799752b
MD5 dfac0ee865997f50739fdb5426759695
SHA1 2a898d9643956ba55971e9d467bc0cdc576a05b3
SHA512 d7228f0fe82195bddf16d1e112673f58c550487ab9b767a22afafb455e6af35e78068cb5f048276a0e644b7ebe54000003f4f6df7dd76293ff25a198de63c037
SSDEEP 3072:MmYBmSN9w3Nw/Xf2w/cX30LFL5FiVop+xH02y8YQaH0Bv3ARKTeyr1Ez732JQDS8:Mx4SN9w3N7wo3Ol5FixxH7Y1z4SPK4
TLSH
T188446C59B3A40CF5F9679279C8458606EAB27C5A0760DBCF03F0869AAF233E09D3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4bdedee966e01a0507598bdb5c3c42b90bbbd914b3353ecb52139c8f44678e31
MD5 255e22b4672e29d1523f589b91caef09
SHA1 5ebd3c6bc98353ff62f54877bf7451fd1b70bf8b
SHA512 02401b0ffbddd5da7e504aa99cdcf7b2ea1bb4367d2e913d4bb1cd8808c7646997a88c49ef7ffb972b6546fd53df1565237833a374e76aa9c6102ddb31aa4be4
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxPYA+w6N:a6F0eMpAAYEhp2AhwK
TLSH
T1FB456C54E783C8F5ED2710F0444BE7FB65309E2984318E67FBC8EE11BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 e816367928bc4757aaddf8b5bd22ce1ceab1994f7f64d5647674113354b5db28
MD5 e0c57be3dfbf97cb78654f7923462cc9
SHA1 6028cb30089ea7980beff78c4fe639581210d21c
SHA512 302a71bbd396c81f42a18885465f97fbf3180288cd5e9b866224bc7718d127483c4b4391c3364910a56e85a3cc449e28e6ac957bdb63bd40293714589da6ad32
SSDEEP 24576:B7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmPYA+w/U:S6F0eMpAAYEhpFAhws
TLSH
T139456C54E783C8F5ED2710F0444BE7FB65309E2984318E67FBC8EE11BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-150-0x0000000000400000-0x000000000052C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads