dc3bc619a5a75b404e5d0f15a4fcf9b7a529d7a902226c839a5fe0f9406e865a

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_36ae92955b6478a439183e46c1d457e8_cobalt-strike_elex_icedid_stealc_vidar.exe
Size 1.6MB
Sample260807-rlccfsgc67
SHA256 dc3bc619a5a75b404e5d0f15a4fcf9b7a529d7a902226c839a5fe0f9406e865a
MD5 36ae92955b6478a439183e46c1d457e8
SHA1 51e4b953c53fe81f43f55e1785db5a5fe1fa3b90
SHA512 bf964bf161c5bd06d90e4d0c7b8eeee2db9114da45161bfe4b95aef645c3db2d3e86d6fe1d625f1984e8f2fd65a1221e701f1d5e2ecffc94a2c7ed8789af3ed4
SSDEEP 24576:P7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOowYA+wERWuVpEOG+w:06F0eMpAAYEhpfhhwUPrEXj
TLSH
T1DC757C91DB8794F6EC3305B0C057E7FA5731AE6480618F6BA2C8FE15BDB1E016826736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3208	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_36ae92955b6478a439183e46c1d457e8_cobalt-strike_elex_icedid_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3208	4120	2026-08-07_36ae92955b6478a439183e46c1d457e8_cobalt-strike_elex_icedid_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_36ae92955b6478a439183e46c1d457e8_cobalt-strike_elex_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_36ae92955b6478a439183e46c1d457e8_cobalt-strike_elex_icedid_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX7643.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7643.tmp
Size 1.3MB
SHA256 9ccdc245f701775df14fbc6ddbcc3796ef93309a8f9b74473daf9a78d22e0d5a
MD5 4f15f8367d6987ca43f445ef6348495f
SHA1 d614930daf9447803e1c7234c38f14f61d1f3042
SHA512 df63a3225a59ca9e8faa92d3cfaa1dfa7781cd88649e3bb371e248d16bf0a61360f189acc1bed05433a18f14e1ef6ce8f0111e3faa9cce87e3958a4bda064c4d
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOKwYA+wl7:X6F0eMpAAYEhphhhwN
TLSH
T1A5556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 344KB
SHA256 1bdc9c4f34c3d79e88bbb47af9484a40e867dfb49a0cd04b7043a19591e24677
MD5 884e8bed757fafa868aa0599ebc56b63
SHA1 bfea458131e1e5f50921086aff180aa9911efead
SHA512 8ecc1060b9d0b246bb9ccc965dec4a5e834c256ab44085b4e82d49f5ffb2c648e78504572c435547bdd86d315d6bfae1d25a57f2b33e0dd0c6ca957f5856ec97
SSDEEP 6144:JILSV6vjGXhrnNMUH3H8miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jF:auV6ElnNMU3G+1q
TLSH
T1BD742882DB8820DBEC369A30D1B0A7554B3BF9E0B9D99FAD11AC3D2D7C54A409C13779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 bbb0984d73570b9679522fdd1c95221ae6cf36fdf3631b0498c3c2cedf2358b5
MD5 798c2630ed5cc1977630b8a45a411bd3
SHA1 d2886ee6f30dcbd9cd9e10cf1099bd711e05887c
SHA512 0462e9ecf408485909d4c3845bb1e10e724a51139adcf26dd8d63f029c01ac9926e63f74d33f0e3b18af57096179c6e5da435a4fcd229ae41f402a7c15ca1d6b
SSDEEP 24576:P7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOowYA+wER:06F0eMpAAYEhpfhhwU
TLSH
T192556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 b51f5fdaa8dfba9bd2f895c48d566328610c353e58c8663c070256e5c3d0e7c5
MD5 2fd666bce8390819e73110765b210109
SHA1 c5a4dd46860f1c99ae595d0f55217fe4e3ff9c6a
SHA512 4dc719c7c9ba2f5739026cdf83a91419569d2e83ced1846491a7143778501adae3269c474934dd765a60588a356d49a8f670d80eeaefa55b82177dc3a35b4805
SSDEEP 24576:f7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxwYA+wqG:k6F0eMpAAYEhpahhw9
TLSH
T122556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 fe4fbc2c84b348676e759a4b872d5c613b63abfb1e7defd115ef7520a3c7e001
MD5 c0721a36079a671ebeee1de726dcee86
SHA1 9db9a7c222a2a8d8f9b77af1486eaea24c843a81
SHA512 21d9c87ed506765073b02a0ca015bf03ffb52f8dee4576937161dbfbf50aa614a94cfea3d81ee0b8b182c1c5fa34981457796f7792ee9b669bdcc1e533f1ace8
SSDEEP 24576:P7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfwYA+wPN:06F0eMpAAYEhpchhwl
TLSH
T122556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-151-0x0000000000400000-0x0000000000550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads