b761eccd2713cb18be7efc004fd79b2d5fce530c77f518fc4bb7ccefa500cabb

General

Target
2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 2.0MB
Sample260808-g5vm2aar2w
SHA256 b761eccd2713cb18be7efc004fd79b2d5fce530c77f518fc4bb7ccefa500cabb
MD5 d269291daf95405a0e1cd62a217df3dc
SHA1 ad8596486d6b1684fb9652aa0fe4b4a34148caa4
SHA512 c3e7f3538b3336abffcde47ff7caaffe6a67de71164e16db6ca35720df74d44cd47ba56eadc033f64a749eebdbe94c1d1bf19c6e00740418ab7f95726eaa72da
SSDEEP 49152:16F0eMpAAYEhpVYhw4tUSkNCg3U6SZTJw1SmcH:80nAAYEpWhBSCgMHwwmw
TLSH
T136A59D18E6468AF0E42B90F08447D6BBE6327C194D318FDB97D4EE557F73A61293A203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1212	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 1212	3824	2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 cfe6f59555ab153694b74c4352de813fb0fa83a147d19ac19933c48e113f3e37
MD5 e22e191758d8fba23182dcea7d4d460f
SHA1 6483394b7ddef0e39d0902018f8676f53c28aada
SHA512 bf17a58aa94de99c5e7d630b125162e5684a5cb866ba58ee1d14b71a55411a17c95bfbcd6f9093a04c6b2afd3d2dc1c2817fd73ef9836161098bd20d64a04343
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3YA+wmenMYenGJiKEbXWtH:a6F0eMpAAYEhp3hwNMPnRWt4C
TLSH
T11D758E60E683CEF1E92B00F1444BD7B669369E194C318EE7E7C4FE157A72942367A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 5af2aa13f335a06d19ef047b32235644a033f2b260b76820b415bcc4ac13ee0a
MD5 906bd18fb65cb2cf7b7040cd11b76196
SHA1 ff4088b543ab322414eaf98ef1fb0808d3a521cd
SHA512 c18274e400dd5538b7d6dc6a07925b260bfb08d057c696ad2a8f56b39e4bf05af71c216269c61b152a5c72651934e8c625f1903c9365253ee626c19dbdd08b02
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOiqOsRs47WXnueVulvspdb5:U6F0eMpAAYEhpzqT37WXnu6ulvKdfLMW
TLSH
T16DF539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4DDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4DDD.tmp
Size 1.1MB
SHA256 09489da9937b5ee1e035c1851592fa3e059cfd303f1dad3127c961adcdb67e6d
MD5 6cbe98881e7d0966e31eafa37e740805
SHA1 a8c20ae462ffb510815bbcf99892fa5e965e7e60
SHA512 3f0bb447b3e1349310004fc2abd57fecb45b0ad5277697d384ba761d3b8752f4bfd6ca142621ce7f709bf43343046b3d8149181586dbbe765f7723604f5db734
SSDEEP 24576:+7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOSnYA+wvw:16F0eMpAAYEhpVYhw4
TLSH
T179456C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5290.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5290.tmp
Size 1.1MB
SHA256 4757833fd0c981ef9e6180d4ffe1ec7f493609429695bb747cb52e8081fbc9d0
MD5 3cbf140107aa6b7250ebecb3ab1b3bfc
SHA1 b0498aff38f480c6788e08fae98c15f86f706e17
SHA512 2b94f08c3c7216bb34cd1dee2869a62fee275c064877ad10569aaaa73eed24bda9af3a1b9082b6f809f40e3a43b7d1ff432df1da53320cd745a8f1803bbfa087
SSDEEP 24576:a7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOGnYA+wms:J6F0eMpAAYEhptYhwb
TLSH
T1EF456C54E643CEF1E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX52F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX52F3.tmp
Size 1.1MB
SHA256 ff15f31e2874d3923034d671fc70fcb5c0395dcb8ae5c6e0d1b5f2878085007f
MD5 8d8a109ef31cf57bafca5c2c484ea3d4
SHA1 9ac8d5f1a4fdfc0d0c5ea4f9a43a6cd3922aea87
SHA512 7d91c3f1a453e48a5fa8c6faddca7bb0edeab68f1a1a18c05816c9481dab00e2cc7c9ab43b6c92861692a0b5ded2f62e85bf17dd9f3f4eda4a7acfdf2450f62f
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORYA+wvj:e6F0eMpAAYEhpBhw7
TLSH
T169455C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 893KB
SHA256 f1eccb9ed9dc75f1e6d3027e3ce5a5b3cc1a52e9fbb462479320c623fef4dfd9
MD5 84a884bd8990c5a935971edec8683e8d
SHA1 ed8bffaea07766975e064ab6f984c4ab89db4015
SHA512 68099b671c57c5543393727714c45bd6cea728aee211a4775cfb446386f354b7f1df8e9c64c898637651289033c2a1dc59ae0098c4fb0fd74dfd6bf05c799e6d
SSDEEP 12288:94GQDSkNEBwMS3U9haSKSHRye/7Y4Xf9dWQpvw9URUS4CGDCEky8LypISIL:94GUSkNCg3U6SvN/7TpvwqUSrSbIypY
TLSH
T114157D2E669C02F4D1B7E274C8925506E772B85A1721978F03F086AE3F676B09E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 8353b1692ad62663c47434f799de651c61b6316bf2024b99b46294e00f638116
MD5 4e1adfec7435f7b1733c736f02479c23
SHA1 7d14a95c3f0a0cb2f80fe9b02a3c9787a4aecd9c
SHA512 1cb17fd56138fbafdb58303bc9e17dacc2ea435125dd72dd1bd3b06b00fde80fb47b7e5af8ea21ce5f283aee2761c166fa33f05a85047dc2a252227db828aa44
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPnYA+wjB:F6F0eMpAAYEhpYYhwl
TLSH
T16D456C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3824-259-0x0000000000400000-0x0000000000532000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads