f7cbbc2b499fa21f95dc490bfda6e716ddf0d9b1e532a9545da1ee7ef100079a

General

Target
2026-08-08_15da6d62ed18eefd19236b80c54fa46e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.9MB
Sample260808-hed32abj6z
SHA256 f7cbbc2b499fa21f95dc490bfda6e716ddf0d9b1e532a9545da1ee7ef100079a
MD5 15da6d62ed18eefd19236b80c54fa46e
SHA1 ad1a84cf18952a03e0bd0b656098d7f66c457fc1
SHA512 bee590b26ec10404df418e84e92711de2377f23fc154e0157b36cebad3a9bb42cf24db0ca85c1149a992efe777682ea66ca26203e40500a0ac5e2178da64b0d1
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+wgRdOv1fY92Qz+vOmQ:e6F0eMpAAYEhpihwA4fY985YW78/Es2y
TLSH
T185958C65EB8680F5E82341F1440BE7BBE630BD1A41318E5BA7D4EE05BF73A512A3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x001300000001c513-150.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 1 IoCs

pid	Process
6072	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_15da6d62ed18eefd19236b80c54fa46e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 6072	3128	2026-08-08_15da6d62ed18eefd19236b80c54fa46e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_15da6d62ed18eefd19236b80c54fa46e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_15da6d62ed18eefd19236b80c54fa46e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX65A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX65A9.tmp
Size 1.1MB
SHA256 fd42b6745efb5eb06f2ed94a343e7e95b3d474f22c76b12f1d57888afb99830c
MD5 e6483daaa55d4967513546be8248a2f4
SHA1 9a8601a39da82218baa921ff4d56e6bbabc2f774
SHA512 e0d367e3fb89b285eaaef8e54b2bed3d0bcad7e84a63c01c2edfc68426171d66c32b3ddc531f9c8c0fc53aed23a2723858f271874495fd0aedc644adefa0ed09
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuYA+wVM:W6F0eMpAAYEhpMhwW
TLSH
T146455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 768KB
SHA256 a85f54bb423418d4e250c3a14e455bd995ed9e2b84d1e44572c2edc7970a56ad
MD5 4172236f7586ab52f24dfd0bb8ec02ca
SHA1 efba09872cbd216ba336f81a492e305f0587634b
SHA512 0bf23b24fa0ad632056bab34cc3927b460026d84128c37ba8c6cd3b5475362528d3ef2fe4aeb6f43e06908a270ae17fda3aa34d4a6b3774b55a1ce035112a547
SSDEEP 12288:R/5YDT1hEmYNQW2FbVnkz4lvOmYCDpx4zQ8/Es2wla+D:ROv1fY92Qz+vOmYopx4E8/Es2i3D
TLSH
T134F47066EBE801F9D4B6C176C9165616FAB1781B2B21DBCF03B081593F277A04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 0cd8c50af492be770c55dfbf9e211251db857d41278fbd18969c76dfcdb20d58
MD5 f9ebe0fb9262c9ecb741f2e35073f652
SHA1 c19d3c340e8fb6bf0483e2099eacc7c5f066a755
SHA512 ae2d5dfa78c43dedc773008a61d56817ea19078441808a8718c272e83164502007d04ca98e83a93cc58f4177a2aeead16b897ce45bddb69296313d14fd182f14
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+wgR:e6F0eMpAAYEhpihwA
TLSH
T1C7455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 b5512030b5c982202c78107e3c5b4e8936f90f93a29ca85ac9d9d72553cedbbd
MD5 86c80d55bf7ae8a0c050373e4ab72293
SHA1 4ca968e34ffcde0a62953bb31e65f10a816c2f76
SHA512 5373a4a7c5f127d58594c77107a5472b23706a5a41c1a2f0c95856a5a4cd0e4a2e46abb38422ef14b923c11ce39962af14ee9f65d6f5fa9da6a9b3be67aa767d
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBYA+w4S:e6F0eMpAAYEhpZhwj
TLSH
T110455C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 d9fbb94996552c954b4707e667eb3a46318adc9d1ae7f04b94b8e06248915fb6
MD5 3b49fecefa4cc662c76b21a916d0d23c
SHA1 d920b96d27c20073eebb9609a0b5b2ba6a775e3d
SHA512 5ca1476b0d6a42a21a39402535df714fcd8314f6f41f791de0a97c2c571b1427c40e1277c987f6ada63ccd32c989419a7a3a354d94e12a492f88abd7950eb9df
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOXYA+wV0:i6F0eMpAAYEhpHhwe
TLSH
T1A9455C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-151-0x0000000000400000-0x000000000052C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads