f814be49f4a66fc57bae89d55f7d8144066a9e106f63e8698c92e45d255c5df1

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_00f3a7a21afc348865fc81b4da6f06ff_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Size 2.8MB
Sample260808-hf41vasbpb
SHA256 f814be49f4a66fc57bae89d55f7d8144066a9e106f63e8698c92e45d255c5df1
MD5 00f3a7a21afc348865fc81b4da6f06ff
SHA1 b4524ebe8eaef67d33376d406d245f170660d401
SHA512 73237844cd9697a751b45152542c3568df7a091ec2e0393020998bcf1a3870da95fe61a45fc221fbb5eb629d286e3afe395169098400bf2c108eedff9d779c6a
SSDEEP 49152:b6F0eMpAAYEhpAhwylP+ByStjQ0Q0pMAHM8636qXueRaQWe:q0nAAYEpAhTcBK8yj
TLSH
T1B9D53A66B247C0F4D45A50B0CF069FF6D5706C2DC2E28B9B56C8FE11BF326A1397A219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000001b815-150.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 1 IoCs

pid	Process
4472	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_00f3a7a21afc348865fc81b4da6f06ff_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 4472	1512	2026-08-08_00f3a7a21afc348865fc81b4da6f06ff_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_00f3a7a21afc348865fc81b4da6f06ff_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_00f3a7a21afc348865fc81b4da6f06ff_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX8C7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX8C7A.tmp
Size 1.2MB
SHA256 4dce03a4dcddfba8cc5ef96f47db692534dc5efcf50351244ff7c906c25375bb
MD5 ad21b88507cd2240adeba36b13a96825
SHA1 9bbfd3341a67934e41ca990abd60f73b06a251b6
SHA512 6f428619de5a4f0b2ad24f728d64b36e8ff6a6a77a8a4ecf265d73899a5cc8a4c0b65121ebae6340c15f2121be665be66e5b1d2d8058fc5c0534531cc54e6e72
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsIYA+whz:76F0eMpAAYEhpFhwJ
TLSH
T1E8456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 1.4MB
SHA256 a0a798830f92ff3daa6719aa38d62abd2e221d9256d5179063e8d4dab6b9078e
MD5 202e55f2e36b2767322502f8d8f729d3
SHA1 ab081cf4beb600574ef1c4f5313cb647ad6064f9
SHA512 4279ae8fd89d380625652ad47b4e0a4b7e4721c9ce7394209db1796c79521e0072506a03d88b318fcfa775e4005973aab54a0f5cef9bb68b578e5f47dfb0f0ea
SSDEEP 24576:d3lxPyPV6uWawStjQmU9qQ0pKJFuEEw5863rAVqsIpgcKcRaItnWdOf:JP+ByStjQ0Q0pMAHM8636qXueRaQWM
TLSH
T19E657D1B96A800FCD1EBD278D9164A4BEB76780B037296DF07A046962F177F14E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 8ae53afe01e0360c5b693ed3eb2648bbd88b10b62a9d74264249600770c2b490
MD5 60c6ccce3ef1b7027a262f30c92bb81a
SHA1 30cfb16af0a99179ccbc95c3b5700047a5242bdf
SHA512 6d599109bda1c8d60c5fd747ad9e09523b67792db35646581873816017c82f7bbc2838f2e72fd3758582ae84a9383b907c9378d7251275c6524c14758f00d14d
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlIYA+w8v:b6F0eMpAAYEhpAhwy
TLSH
T187658176B647D4F1D81A14B0CF0AABF651604D7DC0E28B2BA6CDFE21FB7195134AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 36275174d527d5963bc0c01e423b40e2873fba62ce820111366be4d032cb26de
MD5 807058c7514375504f91996f7f48001c
SHA1 9e91aae001468faf2fdd7d0de3677cb6ec90f3dc
SHA512 07ecc22f4fdd3b5e9c4b2e2c7cb7028e1d2674d0d9cb948815d4d6977528bc8f9bf93aae33fd5f7c6d375048f07e9eac1c95dffec82c99c749789a5d7bd21c08
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODIYA+wgG:v6F0eMpAAYEhpOhwX
TLSH
T1F7658176B647D4F1D81A14B0CF0AABF651604D7DC0E28B2BA6CDFE21FB7195134AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-151-0x0000000000400000-0x0000000000576000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads