3a539f1738582318f40b3bd0c3a487c0b94476c3cce7d21cc3758c0d2e19cb24

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_6ef9f326b376403978edddf549496526_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Size 2.1MB
Sample260808-hagncscc22
SHA256 3a539f1738582318f40b3bd0c3a487c0b94476c3cce7d21cc3758c0d2e19cb24
MD5 6ef9f326b376403978edddf549496526
SHA1 b4fb44a4461b2ab8eecf1dca8df2479f2ce57c58
SHA512 bda18806054264c7eb81be3e56431dbf0c19bdb14c24085f85a67d577cdbd94e02a687ced39f2860c7b52c92192c3f0645854a1538bfc8e88d95c3ec8c94d98f
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO1YA+wI4QBXPoKff21ci/oO:66F0eMpAAYEhpphw5QB33Eot8/Esoe
TLSH
T103A51876B687D4F4D81A50B0CF079FF695606D3DC0E18B5B96C8FE21BF3255138AA20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c5fa-152.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 1 IoCs

pid	Process
2164	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_6ef9f326b376403978edddf549496526_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 2164	6128	2026-08-08_6ef9f326b376403978edddf549496526_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_6ef9f326b376403978edddf549496526_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6ef9f326b376403978edddf549496526_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX867F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX867F.tmp
Size 1.1MB
SHA256 5678b25846eb81dbc028bdd0bcd01caef0d120c0b6943f6b457cb1b33a897872
MD5 109b91dd99f90e7e50e3cecd56004f2a
SHA1 eb6c78c955814c9f6654684a3ca3b0b61c7e5af2
SHA512 c421c146718a850ce40d02b463ba65377848a5af25baddf4f4254389b0e16d270b4ac7e96c669229e1acabe60ddb414c730c2ca0db54d1f6e546fff0977f5e94
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9YA+wV8:y6F0eMpAAYEhpRhwG
TLSH
T17D455C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 707KB
SHA256 09e087ecd47aa52bee13017b589cb83d69c8cf9a4a253b517b2fc00040b33f5e
MD5 9d38fcb03206313d27867556b4d456a3
SHA1 b021270fc42fbe478b5e9d3e9d890c81922bffb0
SHA512 e6e812cfef7d38375ed87b6291c43876c60b12d48fbbebad7d7a70bab81b654f88ffbaac782a3858b73aa68496f8afbe6e044685cb938d48cc6e011a7005bcca
SSDEEP 12288:O7BQ2PoKHgyf25zv69tChCW2waDXgQR8/EseodU0pp4:kBXPoKff21ci/oX98/Ese0Usp
TLSH
T1E8F48E16B7E401FDE1B7C276C9525A26FB71780B17319BCF03A046952F2B6A09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 70e74de93199624a339be0515f577002ff0fb9f230ecf303316213b6b5eddcc9
MD5 2ff3bfa584deb0bac114ba2adb47dd53
SHA1 5ca78643dcff5bd90b874be7c60501df97f635d9
SHA512 8fac4263d54ca842274b61ae56e5fc44eb22052f600a18bcf0411623de95f09f2ec69820e2e992b3942501949dd86ee3bdf0be94d69e037c96923b98f66d12b8
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO1YA+wI4:66F0eMpAAYEhpphw5
TLSH
T140658076B687D4F1D81A14B0CF0AABF651604D7DC0E28B1BA6CDFE21FB7195134AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 5b20a56da3bd50b85356cf8195eac5d30c9249a99fe46421e0dd6eac3cbdd88c
MD5 8e3e70e10400420fe6f35e74a32bb133
SHA1 7d5e81423c2b0cd3e2cefbe19b0e6e7996c8ffe3
SHA512 50ba4590bc4c1ba051184136b24ce6635bb2815125e55d1c9b34439953feed179776c828d0266f76688a70a439cd017be014b05d1312608f38b10b09b52fda11
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOCYA+wgZ:a6F0eMpAAYEhpchw0
TLSH
T19F658076B687D4F1D81A14B0CF0AABF651604D7DC0E28B1BA6CDFE21FB7195134AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6128-153-0x0000000000400000-0x000000000056E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads