e87ae41027131563a04540e709152351d95292c398e3c398102de339d35ac3e3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_2f0e422cf2eb4e25744b190259c3c54c_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 5.1MB
Sample260818-aybs1sbr21
SHA256 e87ae41027131563a04540e709152351d95292c398e3c398102de339d35ac3e3
MD5 2f0e422cf2eb4e25744b190259c3c54c
SHA1 66d9c1b37f9a46ff0d581ba5593b46e3c96928a0
SHA512 dffe050b870fbf3dc4d9f3be62b847439349c3a07e7937355e4753ba6b7973fc2b034406c07e6845331cedb52a69242ffa0a2fd805dfa7144e4dea945a32e393
SSDEEP 98304:C0nAAYEpKnjhn9/fh6ImzzJoDfuBcMv+A73XA4:nNYnR9Hh6ImzD+F4
TLSH
T1C7467C50FACB94F5EA031570449BE37F6330AA098335CAD3DA84DF56F963AD21A37216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1648	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_2f0e422cf2eb4e25744b190259c3c54c_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 1648	3584	2026-08-17_2f0e422cf2eb4e25744b190259c3c54c_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-17_2f0e422cf2eb4e25744b190259c3c54c_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_2f0e422cf2eb4e25744b190259c3c54c_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 62d1bdd6c7b6bc75db6f40d7beb6a286d923c1a764fd3b9c277b10c39b7a2b8d
MD5 30bf3a9a1189d1d46eeb45406a6b5a6d
SHA1 996a5099b097206d41b2f7c49f526a92a57de941
SHA512 285401874ccab52895f33ba36fb4531da71dab794ffaf1f0faecec6464340c20f0871151eb801ef1f5cfd966eba2d442c0100efe05a4699d4788bc5092e774f5
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEnvaYA+wJE83npi63iZ:n6F0eMpAAYEhpxnjhwa8XpiMc
TLSH
T189857C50F7C780B5F97316B0496BE3BA5530BD218831C92FE7C8EE0979B2A51A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 0d4915a1be22b2a99331d7f32506aea8e241b5466a6f64b07a13930f265c05af
MD5 4236d8b7706a9ddfef8ae8a6af042f30
SHA1 ef8200fe14cf5b6b0cf35a40be2969820ae9b360
SHA512 29ccfac32e3814ff0779d38ba36f68a77eecf95df334a422e6ef1c7df95bb9455eea7e967ced27bbcd89efdcfb7a16325dd1fb0e88420547efa31903ce8185b4
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnqIZRs47WXnueVulvspdbl:86F0eMpAAYEhpOqs37WXnu6ulvKdfLMq
TLSH
T1C0F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX274B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX274B.tmp
Size 1.2MB
SHA256 4bfbcffdc4b45bcb11e5659631b88c441c70da37e77216ac5def43b2fd8cc3d0
MD5 849952af2ad0d553c012b59996fb7988
SHA1 3b5d973291b37c05aceeba9b0bbf56ba112e309f
SHA512 93e33e13d8c7b345eb4703aac9f250b957b9491d5b281ea23f6b5beab269ee1821675ae95bba8c9020663a594e50c6feaed0b819d449ce843e80b1bd4bde66dc
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO7nvaYA+wJM:T6F0eMpAAYEhpKnjhwC
TLSH
T1B6456C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2A59.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2A59.tmp
Size 1.2MB
SHA256 c8c21f57b37bd8ce4f7fb6bdcf0337099ebb7017d5441c0085d9fd0150c539d8
MD5 b361cd9ce48cd4d2082f6ab28068c00d
SHA1 a7ab7f8345bbef5718af2e5b06de276d2966994c
SHA512 6ce986eda58c306b08be80437bddb4dfe175eddc413ad9feae0aec70e465cf40f7f7f9b50b60b0f31684ba23b30842b8b9b36aad35f2f685e4972cddf5dc07eb
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9nvaYA+wHR:76F0eMpAAYEhpMnjhwx
TLSH
T13D456C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2A79.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2A79.tmp
Size 1.2MB
SHA256 fd70aabb833bf0a617d898b2989e2eab863e5113f90506a30e53823053be28e2
MD5 ee99cbd53a9a90c27769945d2b13107f
SHA1 0317d1f34cb737dd22ebd25ad5dc9edbb495aa72
SHA512 72076b78e1d0d197330459d873619011b5ab709a9c92cab32cd9d732ad55cbd4e6efb4af537781725d8196b790ade118ef54019e81f2c3b33566f065428be7f4
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6nvaYA+wJ8:T6F0eMpAAYEhp7njhwy
TLSH
T12B456C54E783C4F5FD2314F1444FE7FBA5309E1A40318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 3.9MB
SHA256 7ab635bfad8f5e753bb3fe894743f9fab9352d0a93686b2cb430ddd0784262c2
MD5 9663ce631822cdc1901ec62ac04ef9b5
SHA1 38c52598624ff74c9e656a504edb5a5bd677adf9
SHA512 42d3164cd36cdb36a85daab8d873ea93b43e7eac3ca34045f9f4630884278d3e77bb85deb9903ef19a94d5aeed0c459809d60df4a8c77100a9556ab3cea5b43d
SSDEEP 49152:JKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gjg+A2deCMmwV/vJu2mWG2mrk:J/fh6ImzzJoDfuBcMv+A73XA
TLSH
T153166B51FEDB94F5EA035A3045A7A37F6330A6098335CBC3CA405FA6F957AD21A33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-269-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-261-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-265-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-274-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-278-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-282-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-284-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/1648-286-0x0000000000830000-0x0000000000C3F000-memory.dmp

Download

memory/3584-260-0x0000000000400000-0x000000000053D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads