84f72b31ca1461b592ac2ab65506193bc1c3f41c6d717b3f934c568a290919b1

General

Target
2026-08-07_bb2be0ed2795c000bb400288ca98d1d0_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
Size 2.0MB
Sample260808-a38csawgjf
SHA256 84f72b31ca1461b592ac2ab65506193bc1c3f41c6d717b3f934c568a290919b1
MD5 bb2be0ed2795c000bb400288ca98d1d0
SHA1 22abf7ac2cef2ae73dff518980fea2799f3f568a
SHA512 13bd54799cf07704d0e3d112ef8007ceab6f9c30935be88cdf6db4e82d9288d0cb1bcae7f13512b78c4463f13c40e33507540c0ab05e4d7db1e4fcdb361e5780
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPS1YA+wIXu8Vllg8tlC:+6F0eMpAAYEhpUS+hwenq8tlC
TLSH
T145958FD1EF4270F6EC2349B0B017E7BE9633BD648461CE67A28BFE247D729116816325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4500	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_bb2be0ed2795c000bb400288ca98d1d0_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4500	3692	2026-08-07_bb2be0ed2795c000bb400288ca98d1d0_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_bb2be0ed2795c000bb400288ca98d1d0_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_bb2be0ed2795c000bb400288ca98d1d0_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4E46.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4E46.tmp
Size 1.5MB
SHA256 7a6865d1d4895c42811f2ffa9cb565dfa6931994cd6cee70edc91a2ded82b307
MD5 caa4e0685918ecd5b992b5f9780d0636
SHA1 c28e0ac514b87da58897d28003d3f9bb28e65af7
SHA512 125a786ebb9f485e5feb1ee5a99545a2bc1a4ddd9625aca34670ead388e3a0c28fd94062ba8b1d943c5bf6b83768cd0947209992c38963dc9588e30a77182616
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPS1YA+wIX:+6F0eMpAAYEhpUS+hwe
TLSH
T17A756DD1EF83B4F5EC6308F0710BE7BE9533AD2584228E66F68BFF2579729112419216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX50F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX50F8.tmp
Size 1.5MB
SHA256 b2384f1b5c55d21b0c79915a2dc7923ef0bfdd6d4f16990d18f6ee100cac7be6
MD5 f99fd50fe33a1ce62f28e098f7f44ed1
SHA1 6018cff774f2838c18e1e435f3f1569691287eac
SHA512 111a3328a102f4431d98fe5bb8a88252999dbc2797570f1f98b1f5587bc925c6c008cad15f20c15947d98f264e7c9a83a8545e64c9f95ab17c2a5f7cd445b81c
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeS1YA+wmn:96F0eMpAAYEhp5S+hw4
TLSH
T18B756DD1EF43B4F5EC6308F0710BE7BE9533AE2584228E66F68BFF2579729112419216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 425KB
SHA256 fd2abf44f50bcf46f6fbb54e89b44e1c7a1a24ae5e55f89e749ff9a839a03c59
MD5 3fad75df67f65173a0d2b21f0977a00b
SHA1 12d4677d0daee17cc0fc69ed4034dfb1875a4c42
SHA512 edb0c24026cd0a64dc91b37d2622f3c11e667855e32566e15c9cfa11311063b949188b88455a51a78df9c64ba532a57c9eeb1e4039b5183d9b3693292a7638ac
SSDEEP 6144:Zs8VxbvEYEoQV6tovwmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVL+:Zs8VxjEYgV6toK3s
TLSH
T118943B41EB8804DBEC329A30D170A7599B37F8D0AB95CF9E116C3E3DBC666409C26779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 6ec180252c45b3bff2db7237e12c442942fd53fc2687f51f546f928b89dbd4ed
MD5 9be0bac09386ac27eda231bbf6a6ad55
SHA1 e339d2bb593564628682b6568efa893072d36dfe
SHA512 6149f287b7ad4f302d68a9028c3a3cbcd44ccfc0bf3929c2a97495953712d5ed3e8941700d4f79af424d797d336833c189f3b8ae2a5d4b2812274315adcf3050
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOS1YA+w0w:e6F0eMpAAYEhpNS+hw1
TLSH
T181756DD1EF83B4F5EC6308F0710BE7BE9533AD2584228E66F68BFF2579729112419216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 c9d5da2752de07077ceeee264b6b87731f8b9fb00d3d736ae95c5f452cda5b22
MD5 c7e0523b818180d14b749da77369b23e
SHA1 7f5c37390bec3bc4b7840546d6e890f362d219de
SHA512 24307afcb68f8878e161b620a6b5d2d392ff403ea87cd49f9284c5bec7dc1364d00dbf1e20f87219936ac3ad9c10aa58678e4de69ffa967cb260721a937f57ea
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsS1YA+w6b:i6F0eMpAAYEhpvS+hww
TLSH
T117756DD1EF83B4F5EC6308F0710BE7BE9533AD2584228E66F68BFF2579729112419216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 303622182f06b6f5990fdecc1cd01493ee603525c9fd468250fc4b45ac77ec1e
MD5 509c463ea030ce89dc10fa40c41df4e1
SHA1 e49aa55af27a4846f27aa875835930a3e61af60f
SHA512 68874a214ddf89d0accb94345da4c79112ee20a1d3630fe1d176fd0ae9a45699a5f97158e01b9f4f2753d5718aec762d1b935f40cb868ac5bf342b647c28f88c
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOZS1YA+wmV:e6F0eMpAAYEhpmS+hw+
TLSH
T1F5756DD1EF83B4F5EC6308F0710BE7BE9533AD2584228E66F68BFF2579729112419216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3692-153-0x0000000000400000-0x0000000000598000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads