a607214b07d0db98cbeacc8d404623551b245c90c3cafca81e1181a1cf4eb9b1

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_d604e1cab2ed9c7200dea4ce14e312b4_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 4.1MB
Sample260817-mkhqmaxhpg
SHA256 a607214b07d0db98cbeacc8d404623551b245c90c3cafca81e1181a1cf4eb9b1
MD5 d604e1cab2ed9c7200dea4ce14e312b4
SHA1 6750cbe96eec90db5b3e26fcf642d0a290f85d08
SHA512 de877d62cc21ed8569a9e46dcbad33324884e62f6b4aa2b5a1a1a6a1756ee273bb1198ad7b032fd1cbd502fbe80422d8bfef43cc117bc3eb351b47122ee5ec3c
SSDEEP 49152:z6F0eMpAAYEhpghw/6HlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw6:i0nAAYEpghS629jht3zpfuOHUn
TLSH
T1AE167B56F28680F8D42AD0B0860AE672E5307C494731A9EB57D4FF253E73BE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4460	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_d604e1cab2ed9c7200dea4ce14e312b4_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_d604e1cab2ed9c7200dea4ce14e312b4_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_d604e1cab2ed9c7200dea4ce14e312b4_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1468
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX89E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX89E8.tmp
Size 1.2MB
SHA256 77ae5fdb5ea034e8f606e77b7795ad95673b4561685aaa1bf934146d361ff122
MD5 b7555825a78f8c5607818eb30964177d
SHA1 d383c89112ee5c4f149b773be2b43cae808596fd
SHA512 03757e4e23438e4e6fbaae26b87389a83f77efee7f4751eed6533c23b4b5b1169a5b2782d3f9433a260c1b916723b712ecbad6ec84a207ce353060b05f15ecd7
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlIYA+wAy:z6F0eMpAAYEhpghw/
TLSH
T136456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX8C7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX8C7A.tmp
Size 1.2MB
SHA256 ccf6f4f0f8536d92b4f624837291e1e61dab556c46d39d36344b18cbc4c8581f
MD5 21bb927dfecb3df6b90f40d0dc20cfdc
SHA1 ba3a8bb71f20cf4e54c7c8e02a7ff8b8fa0dc6de
SHA512 9d7d5d41e17eb26da00af0123053b53c720f117edde2556c68b9acf4971dc7033d109dbff666eee30155df1bc307b02b28ae8bca0258ecb0a42c37f9c92099d8
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOwIYA+wtK:P6F0eMpAAYEhpZhwk
TLSH
T102456D94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.9MB
SHA256 3d60f4ac797bbaba526aec448e3b6399843a94cb1fb95ce256c8d14ad770a84d
MD5 b6ab38ce565b04bfbb9064be9f3b3872
SHA1 a52e2882b21927bea4238a4ee43805506c3df9c5
SHA512 cf2ad3e8467226f0e27c35990d093bc19bf3cdd7b7f634ba9ae61daf66aa4d101a34af97c4dfe3e7e48a1d6612f09e4436429fa056efd719909ae4592f4b8ccf
SSDEEP 49152:uHlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw:u29jht3zpfuOHU
TLSH
T1B3E56B13F29A50E8D05AD0B8C74A9631F9717C850B2069EF0394FB252E77BE46F3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 adb86c593403df0dd912efc68b73eccc14284570155fc2a957244daf14c1e34e
MD5 7ba7a1bcd535e3858853b5334a32b0b7
SHA1 1e86cf606334ddbaa2cfbfbf983b9795f317d394
SHA512 2fc333817ee65f5a2e81ab5fd7ecf7497d7bb48568a463cb5e9d3c8c8e95a5d8b025494d6e979a634ca600a8f20a8f7bdddf6f5c4ec7ce0d6c279dca47d3d58a
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVIYA+w/B:T6F0eMpAAYEhpohwp
TLSH
T1D0456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-151-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads