b761eccd2713cb18be7efc004fd79b2d5fce530c77f518fc4bb7ccefa500cabb

General

Target
2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 2.0MB
Sample260808-g5vm2aar2w
SHA256 b761eccd2713cb18be7efc004fd79b2d5fce530c77f518fc4bb7ccefa500cabb
MD5 d269291daf95405a0e1cd62a217df3dc
SHA1 ad8596486d6b1684fb9652aa0fe4b4a34148caa4
SHA512 c3e7f3538b3336abffcde47ff7caaffe6a67de71164e16db6ca35720df74d44cd47ba56eadc033f64a749eebdbe94c1d1bf19c6e00740418ab7f95726eaa72da
SSDEEP 49152:16F0eMpAAYEhpVYhw4tUSkNCg3U6SZTJw1SmcH:80nAAYEpWhBSCgMHwwmw
TLSH
T136A59D18E6468AF0E42B90F08447D6BBE6327C194D318FDB97D4EE557F73A61293A203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1692	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1692	2632	2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d269291daf95405a0e1cd62a217df3dc_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX9544.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9544.tmp
Size 1.1MB
SHA256 3b9a1ef434cdf52a18f23c978c4302eee099cb008bf299e237056136203df385
MD5 96192af10439059df280443eaae666d2
SHA1 01c999373a313642adb066a1590a558b0cbf3b83
SHA512 3f99cb989538e59e03fcd93e19863820b8a2d3f3395742f9deb95c5408e56a726fcd7c1dd09303c75d7ae9e51319c3609f1ec1a76f9cc8dc79f0698bad02776a
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3YA+wme:a6F0eMpAAYEhp3hwN
TLSH
T1F3456C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 893KB
SHA256 f1eccb9ed9dc75f1e6d3027e3ce5a5b3cc1a52e9fbb462479320c623fef4dfd9
MD5 84a884bd8990c5a935971edec8683e8d
SHA1 ed8bffaea07766975e064ab6f984c4ab89db4015
SHA512 68099b671c57c5543393727714c45bd6cea728aee211a4775cfb446386f354b7f1df8e9c64c898637651289033c2a1dc59ae0098c4fb0fd74dfd6bf05c799e6d
SSDEEP 12288:94GQDSkNEBwMS3U9haSKSHRye/7Y4Xf9dWQpvw9URUS4CGDCEky8LypISIL:94GUSkNCg3U6SvN/7TpvwqUSrSbIypY
TLSH
T114157D2E669C02F4D1B7E274C8925506E772B85A1721978F03F086AE3F676B09E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 09489da9937b5ee1e035c1851592fa3e059cfd303f1dad3127c961adcdb67e6d
MD5 6cbe98881e7d0966e31eafa37e740805
SHA1 a8c20ae462ffb510815bbcf99892fa5e965e7e60
SHA512 3f0bb447b3e1349310004fc2abd57fecb45b0ad5277697d384ba761d3b8752f4bfd6ca142621ce7f709bf43343046b3d8149181586dbbe765f7723604f5db734
SSDEEP 24576:+7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOSnYA+wvw:16F0eMpAAYEhpVYhw4
TLSH
T179456C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 8353b1692ad62663c47434f799de651c61b6316bf2024b99b46294e00f638116
MD5 4e1adfec7435f7b1733c736f02479c23
SHA1 7d14a95c3f0a0cb2f80fe9b02a3c9787a4aecd9c
SHA512 1cb17fd56138fbafdb58303bc9e17dacc2ea435125dd72dd1bd3b06b00fde80fb47b7e5af8ea21ce5f283aee2761c166fa33f05a85047dc2a252227db828aa44
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPnYA+wjB:F6F0eMpAAYEhpYYhwl
TLSH
T16D456C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 0cf24ad1e48ca0ce9e533fb17e1da7286d72c22530f2d7d0648b45bebbd4613a
MD5 27c1428b4691d265636ddeb6220ccc03
SHA1 e0ca57c1d3de8afec543d956d23627cbc416d031
SHA512 05d49b2e5cb79b72dc0a189f8489cb0fc87df25a5c6cf8b260dd358b7633bffe6b51e1ffbf9e6242a592d6f081c40c9fff08ff487e48bd7a12ec0df73e6ec62b
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVnYA+wF0:l6F0eMpAAYEhp6Yhwu
TLSH
T1C3456C54E643CEF5E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 500d6b55fa869ea92700a0e80e8884b0829596adcd9b98bbdf7bbd9984e2e4bd
MD5 b5a69bdf5294fb7b644f7697e93ee851
SHA1 559349100049982eb3f906f43400128fe75c6cf5
SHA512 1755adb3b9c7d3d79f8b53c95808483c509bf7b7be4541073a799707daf8f7b8e512c61668cb62a130141f40eecc543411e1b28b1ceaeafe08628cc5998f66bc
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOSnYA+wyH:V6F0eMpAAYEhplYhwM
TLSH
T12F456C54E643CEF1E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4757833fd0c981ef9e6180d4ffe1ec7f493609429695bb747cb52e8081fbc9d0
MD5 3cbf140107aa6b7250ebecb3ab1b3bfc
SHA1 b0498aff38f480c6788e08fae98c15f86f706e17
SHA512 2b94f08c3c7216bb34cd1dee2869a62fee275c064877ad10569aaaa73eed24bda9af3a1b9082b6f809f40e3a43b7d1ff432df1da53320cd745a8f1803bbfa087
SSDEEP 24576:a7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOGnYA+wms:J6F0eMpAAYEhptYhwb
TLSH
T1EF456C54E643CEF1E92B00F0444BE7FB55329E198C318FE7EAC8FE11BA729522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2632-152-0x0000000000400000-0x0000000000532000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads