0405776b353b68db6cb86423232c517b78278d07097cc893b01e72d88d7807f5

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e70665ca78348a7190ed723f5a01777e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.6MB
Sample260826-e7313syxgw
SHA256 0405776b353b68db6cb86423232c517b78278d07097cc893b01e72d88d7807f5
MD5 e70665ca78348a7190ed723f5a01777e
SHA1 a0b784085c7892c87a0ee53d83bc926923ee06eb
SHA512 c0856f49ea09ac2eeb6d7439141861fec826a26700f620fdd1883fbb459861258954a305a76a9d0aea5479e07e8576eae1e174ae58b2685a7ff74be15a2860e1
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhwA+wMctp0bm5FLaOSjkwP:b6F0eMpAAYEhpkwhw9tpom5EOORV/
TLSH
T181756C54E78784F5E92351F0444BEBBBA630AD190031CD6BF798EE14BF73A922939712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6016	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e70665ca78348a7190ed723f5a01777e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 6016	4072	2026-08-25_e70665ca78348a7190ed723f5a01777e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e70665ca78348a7190ed723f5a01777e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e70665ca78348a7190ed723f5a01777e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 2.7MB
SHA256 ae115d86bf599ca968cd54793a2dab305421db28e1f49218ca58452a96b5f6d9
MD5 68a87735710e4694d50d152cd51c9c06
SHA1 b54c4d47606ec776090b3230cefd68c0b1dd8e69
SHA512 ace17af0f7dc4afaa53004cbfb9a8df63a1f1c8253d14eb3bb7fb19b4b7baf295fd836cd7e6bf07d492c20a1c48bc207ce9ba2ccda6f88bb206878b5c8537b28
SSDEEP 49152:b6F0eMpAAYEhpHwhwb37WXnu6ulvKdfLMx:q0nAAYEpQhC2nxuYda
TLSH
T119D56CD1FF82F0B1D49308B1390BE6BED5237D344C228997B7C7F72D6A72691262A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC45A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXC45A.tmp
Size 1.1MB
SHA256 10066897ac54a6d5d2151698e77f45e4d74e653edecb87a2c3a8db4c9d3d367d
MD5 1698eec7d1facd8513a37f5735d7bcbe
SHA1 804ba3de6e938260878fca323845d45006348ce5
SHA512 0ee39ec37c72f914d7c2318df81ff1305d2e83ab96e9d4405685f9dd30e7538d91fa470fdc7acb7b78e6c419d1039c17f896fb249403353bcd25121aef954df2
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEwA+w90:L6F0eMpAAYEhphwhwG
TLSH
T153456CA4E78394F5ED2315F1044BEBFBA5309E194032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 473KB
SHA256 8b042cd8308d448cb7fd047f8c9c6eeed8d05819d5491a2bc8f0f3131702d23d
MD5 a4a3c08b7222f6097a959e79a1e94a52
SHA1 11836df4651bbb606041c6a4472a81c57cb8ba3c
SHA512 57fcceed538c6952be858594a58e6ea80b99af1c2f1cb2869a008197787db56e16f892ab1854f98b99c6c69653b9bd41bed0f132d7bf3c1ac8b9b318fc7d2739
SSDEEP 6144:xLG8Pwq+CO8VkdHMo695FLhsOwrLjkw79NsBk7yxKNeFet1Vp77GkK:BvPkCDV+bm5FLaOwrLjkw7p7IKU8XZK
TLSH
T178A47D56A29800F5D1A7A278C5538A16FBB1781A1761C7CB32BCE7792F236E04E3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 700d093c44d84a02a7099f5043b8c289f0f291262d1603b539752ece13509b6a
MD5 3364a6cd8b87784a7d330dddc2b132d1
SHA1 a8a17170302d1bdaf6403dc3cdf81aeec0d0fe65
SHA512 26c2c93b146f2dbe00baf8a9745d3f4254bfda5fc878a0f22b5243f449d26e6d68029622b8f8b7a30369d10ea2b77c2c00a7625f5bc3893bc742c0bb4c84908e
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhwA+wMc:b6F0eMpAAYEhpkwhw9
TLSH
T1B6356C94E78394F5ED2315F1044BEBFBA5309E194032CD77FB88EE10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 18102d7f35734588de3a7d4a0b35d1a16cd77120c0308ae6eddb53fbab862411
MD5 8e45bd1408edcfb6436e4e7dc07ec397
SHA1 71b782013a064f94327963d80378bd21fa2f2afa
SHA512 bda6b1e0cd2e32a5f0eecbbc22d5749e2cafbda11ddc01589e203c414b622e9ad5fb1137bb8ccf36a624d9355d291e65e74220f77797e5ee3bae2419eebe202e
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOewA+wYF:b6F0eMpAAYEhp3whwk
TLSH
T10E356C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4072-158-0x0000000000400000-0x0000000000528000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads