045b6bbc4348a1dc63216fda85683cd8321e57247dd15a879fe815ffd8d8fae5

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6eed860a63c166aa59a88d272094e430_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Size 2.0MB
Sample260808-bkmtssba36
SHA256 045b6bbc4348a1dc63216fda85683cd8321e57247dd15a879fe815ffd8d8fae5
MD5 6eed860a63c166aa59a88d272094e430
SHA1 9568c9a7a771116b7859a5c08329f664e950610c
SHA512 8684ab486c30a66019b19ff3f45e6734f95af65e7a88a8271e1830f07521b931bfddd1c769524ac2316479370e58542745a1ac301ed9ac7dc5c3767b71e8c71e
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuYA+wVQtKT8vqgqPHu81be:O6F0eMpAAYEhpUhwKtK+HuHu8pi
TLSH
T19BA59D58E78680F4E56350F0484BE6BBE6307D1A41318DABE7C4DF567E73A612A3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3148	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6eed860a63c166aa59a88d272094e430_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 3148	5976	2026-08-07_6eed860a63c166aa59a88d272094e430_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6eed860a63c166aa59a88d272094e430_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6eed860a63c166aa59a88d272094e430_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX82E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX82E3.tmp
Size 1.1MB
SHA256 ee232639e2f08dc82726ac9f7127886bbe42109744c54fb5b51de8f0ef18e24b
MD5 ba793aff0fcb092140a3915ca376e7c4
SHA1 30b2f1150afc267b9f665223249794d26ab8e0f2
SHA512 c0ff2645ea6461d554bf91bed511cc03334d7af56bf9eea23cfb21b79cf0ee5cfbd3fa9d0e940045c2d42dbe67c1be3917d6db001441dd2aed1393177d0e347d
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuYA+wVQ:O6F0eMpAAYEhpUhwK
TLSH
T1E4455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX85B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX85B4.tmp
Size 1.1MB
SHA256 f054e2c3e5da64f50e3a43f1fe948d46da981c3835874316a9b134856519125f
MD5 c0a813c7f728e68e0bb689556ec43893
SHA1 189900c4a3bcfaea6b8396a6b222e3c83498e959
SHA512 46243c0122780d097567091ad36739b98fe4dce65a7a5f2d5f7bc873649483b90fe52606703f7b38671724fab7c56906d171a264a51efac2afd61366725bcb4c
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+wYY:e6F0eMpAAYEhp+hwV
TLSH
T1CA455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 860KB
SHA256 36f85d0d850d52afce785e690214524aec7c62048b87049b12c0dbcd8a0fecba
MD5 8f4c7a059e3dc6280b38e76cdc3b02ac
SHA1 2301f23c4bf9a757d229b0265cddc0f80a1f9aad
SHA512 75904e065ac043d3b3aa7be32db10e34dc259e29af68d7fc563c8f3c0f142f454dfb4dc55f7fe90c4ae874cbcf2afdde3c158906cf56c13045490b12fac3ec86
SSDEEP 12288:4ShKT8MIxPqqM0qrr648fdk2S3ywiKAffMRArnf3Gwm51p0Hmj+W1bqtmowJloU+:pKT8vqgqPHu81bhOU+
TLSH
T18C159F6D96A802F8D2BBE1748D465906E772784A03718BDF03E047AA2F677B15F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 94f80f6ffcfde088ba3fa72e19685f7c2be0083b34ab959eba8ed365200ad666
MD5 42cb0b3360e6c2067f410d59f9af2256
SHA1 b19955b07fca9a32592b1244dd4d824b80b9fa59
SHA512 6d9515f30734043504dcf1aca39c3e689f3ff7df9d23fcafd7fb2870be3de902b725293adf70fb27fc7ef907e2df4c7b76fab71e9d8f9df6b750b3d1555fc0bf
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+wNB:+6F0eMpAAYEhpihw7
TLSH
T12B455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5976-154-0x0000000000400000-0x000000000052C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads