9cd7da8e52cf80fdc19839e4dd095206d02f638ba1b635c39dd8771c289125f6

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc.exe
Size 3.5MB
Sample260827-weshbaaf27
SHA256 9cd7da8e52cf80fdc19839e4dd095206d02f638ba1b635c39dd8771c289125f6
MD5 50d8b29663fbda9f0eb65569f4d597bc
SHA1 9207229c67973f21b2615e2b7e76821be5b7d1bb
SHA512 4be81e1f5f827e662a370c06d9d315006f34fdae396854814551e39e13b2728a841195faf9aa935a1cd7f45c9668da56ce4b242d53a4604315314cb0dab8ea19
SSDEEP 49152:6qabhjbsi69K3ZJF9bmUrqA7z866e+97kpZVNPWpPnrNLX3UEWx+8AIkWy69bk:0Gy97Y7kLPWXM8dc9b
TLSH
T15D06BF16A6E402ECE1F6D2B49D331403EAB37C4A4735A9EF0198555B0F27AE4CD7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4788	Widgets.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4788	3824	2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Widgets\Widgets.exe
  "C:\Users\Admin\AppData\Local\Widgets\Widgets.exe"
  2⤵
  - Executes dropped EXE
  PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

session.log

Path C:\Users\Admin\AppData\Local\Widgets\Profile\sessions\20260827T175031Z_19e8fab7873c1eec\logs\session.log
Size 910B
SHA256 e96bf47014ae1e95eae8bfbb4fc596657da1bfd2314d3259034cfdbd21c5d264
MD5 b7fe38e1117b86518dba88164ec9cc5e
SHA1 8f9ae09a0184b8cac3c514f09f9491cf4fa13b54
SHA512 7b7c5db99b89abacf5d7a719aadd1c336dd74ec052406d42debf25400400744b1e05333814713904c742933346c78228e86ac31de9db0a5a64478dd6abaac726
TLSH
T19C119053ECEFDB9A940BE8FB23401C8461D5301AA680BD16B30D468D5887E1445AF3D1
MD5 SHA1 SHA512 TLSH

Submit Download

Widgets.exe

Path C:\Users\Admin\AppData\Local\Widgets\Widgets.exe
Size 1.5MB
SHA256 3cc796c836a3c93fbbfb4b4d6de55b79c418548c263ecb5872b90300bf98c966
MD5 005278b7a9c152590bfb5a7997d36fc5
SHA1 9b6660f7199a613720931736dd5c3110dadf0c88
SHA512 32e748bf74fb60dd77fde92ce76ebb227054fb7ecddf8a7afcaebcfdc636a1d6e93f4ec52cabc14cff3581fd980e7c94e6ecb9e484931a35a575803cc2aafb30
SSDEEP 24576:POcHGsmOix6n/1khFTWnjAy7XbCuD2M/EaLllcq285+:PObsmOixq1khdIjbjD2M/R9
TLSH
T1FD65BF1FA79412D6D13B937D89D98A81FAA1B8050B309EDB01561DE92E27EFC0F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

output.log

Path C:\Users\Admin\AppData\Local\Widgets\output.log
Size 1KB
SHA256 3e6e66ebe06d454adf608e1581be58da0fb7a6e556ddb6f150613cfb394426fa
MD5 b76c78f33d5d8fe159c91bb71ac33821
SHA1 50387ba6fbcac1c7b2ef145faaefd17ec4960138
SHA512 a4d89b92bb659b2d2fbce5a6a90cb4cfcaad8d305c06816ab435b75562105ecc0c3205ad7ee8646ea2626a462e518a86c0db0dbd7c5a2d21254c3a2e923aa09c
TLSH
T11B211727D8EFD75BD44B94EB23001D94B5D67015A680FE11B30C469D1947E14167F3D2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads