fadcc4b0faec4dd946a4591f7f31210ef9f2a4df9dd4d8cc4898c091212f888a

General

Target
2026-08-25_b71af614b6c8f32368fb679b2ec82098_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Size 2.7MB
Sample260826-pmjrtadn4t
SHA256 fadcc4b0faec4dd946a4591f7f31210ef9f2a4df9dd4d8cc4898c091212f888a
MD5 b71af614b6c8f32368fb679b2ec82098
SHA1 a3d4cb91d76fbcccf9aca93937360f830617b0b0
SHA512 21f9549a9e5b4dad46f38586b3ce3f4ce0ad61ba830220ea4a4868a7ffaf32f055b3d0570ae88082693f9977c194fe77e05e35ef9edf5f75e0239472bdbfa06a
SSDEEP 49152:Y6F0eMpAAYEhphhwa3jQ8UCjvGue9wM8klf8:70nAAYEphhj3jBWh8
TLSH
T165D58D12E3C582F6E57351B0C457D6BAEA317C0684318A9FB294FE0A3F73A615DB8712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5c1-151.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 1 IoCs

pid	Process
5560	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_b71af614b6c8f32368fb679b2ec82098_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 5560	2068	2026-08-25_b71af614b6c8f32368fb679b2ec82098_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-25_b71af614b6c8f32368fb679b2ec82098_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b71af614b6c8f32368fb679b2ec82098_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX311C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX311C.tmp
Size 1.1MB
SHA256 bbefda1295d742d324b7d11b2bb0a53c686ec4b722e67f53e874b6e350e8fbdf
MD5 021723894bc7f3132d7873425a8b68f8
SHA1 cee830a0b4f4b04567985e4c89e0873ff9d5afef
SHA512 1b9c29e0e7db1bfe9d85825139191b89c055470d82f90830230ab51b8f8d836a2bf70f38df2fedd486a9e848a1e3cec9ec6803c9c9831a7ab3bf0e8e85071d36
SSDEEP 24576:a7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOaYA+wxy:J6F0eMpAAYEhpshwI
TLSH
T1D3455C54E643C6F7E92310F0844BE7FB65309E19C0318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 1.6MB
SHA256 678da415b8a27152f022dfa77749547edff325f3aee436fa5803fbb59b6b8af2
MD5 e99a16ae1c3bc83778a95338a832131f
SHA1 633479f62b61f60542386694a7e5befc457339a1
SHA512 dd5e1fa052c5d10c2042f2901146da390d4443c5d75d8193ba0e44050a2bd677377dc36d8d01b49178c02ae1dc7acee0edb10d95c4f20afd9dc26df11ec197a8
SSDEEP 24576:gJQLje1F/3sSYUCjvGugJlX9mM12fRklZxvcP1sk:jjQ8UCjvGue9wM8klfk
TLSH
T1E8757D13A3E843F9E1B3A270C966555AEB723C061A31C78F3260755A2F777608E7D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5dd55bb2460efa0ab1e7fc9c4d646bf8b32b4510cc339790e9ba0604faaa9d65
MD5 c185324de9b24575aa2f37d4f7aae5f3
SHA1 a9a81849374dbcd943d4fb94aec7f47d778f4d85
SHA512 ead019562f00e7dcb0310f1dcc3ead23ab1f6f4678f04f7b146c8501b190aa4f366a3d9d13303a8a00eab0efaa1da836e543a4d8af15a1f56e5a295b5f74d590
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlYA+wRs:Y6F0eMpAAYEhphhwa
TLSH
T1DA455C54E643C6F7E92310F0844BE7FB65309E19C0318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 f90c2ecfd87f5e182811f04f07ea6ba6328ccf4bdfdb61e9f877d197f81234eb
MD5 1d3fe6baf6b80d594697b57a8f53f5e8
SHA1 08e51555b0fa1fbd329daf8c6160fc18ffa5451d
SHA512 97f3d719a56a1d49495dd72208f1a3cadc68059b82e349940a59ea730e86e61293ff3a1cd4d38603e9813320d94fa2dca3abe890c52759819a6547840228953a
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOwYA+w8T:s6F0eMpAAYEhp+hw+
TLSH
T190455C54E643C6F7E92310F0844BE7FB65309E19C0318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 470cf24f169f5cc11d162c51477b6533e803251f962cf8c8a0022266bdfdd60c
MD5 8ae5ac59a82669e6b76ce8667f4cf05e
SHA1 47ca9261f86c58d6fec40142153d57af826438e6
SHA512 9279216f625db4d88a4d13ca31b085aac5d6d308dca894f51099e664c8751849d3f7e0e1427e6a87b6c32e4ae8c0c6b80ccb4237a55f0690cd3d154a3d43efa2
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlYA+wxq:U6F0eMpAAYEhplhwg
TLSH
T134455C54E643C6F7E92310F0844BE7FB65309E19C0318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5c23d037986fc157f21281151f19d132a6b0789759a901cc7f7f8e4f9feb8106
MD5 0cb9003065647f94a2d95f3e006404a0
SHA1 9b7d53486df9ec57c925803fd968091ce623e9a8
SHA512 aef324dcb3a3919547abc8a9a2221ed38f3626a3aad9d335032d24cf9b2c67737399a5962fc2859e2f98d2d2afe786caf748ae7b271cb7d2e41dc71398348223
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+wdj:c6F0eMpAAYEhpihw9
TLSH
T16B455C54E643C6F7E92310F0844BE7FB65309E19C0318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2068-152-0x0000000000400000-0x0000000000531000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads