291de22ab077b366cbc80bcb0ac284f85c061152e51d65a035fbcaa9d1ba8c2e

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_ce6b56bc47d5163607a8aaf6ee60346b_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.6MB
Sample260906-v79fvsygrd
SHA256 291de22ab077b366cbc80bcb0ac284f85c061152e51d65a035fbcaa9d1ba8c2e
MD5 ce6b56bc47d5163607a8aaf6ee60346b
SHA1 06e07c966da8305b4a356cd03ffe4e4f70d33258
SHA512 391ca6d94e86e32214c89ec8dc447473384fdd55c306f891987723d9778c87322ee26a71d15416a29929417b08ab7e9b630b11c21a6d0baee05e547623396a39
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpIYA+w33p0bm5FLaOSjkwI:/6F0eMpAAYEhpMhwHpom5EOORVY
TLSH
T18C757C54E68784F5E92351F0440BE7BBA6306D2A4031CD6BF6CCEE15BF73A522939B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2344	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_ce6b56bc47d5163607a8aaf6ee60346b_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 2344	5564	2026-09-06_ce6b56bc47d5163607a8aaf6ee60346b_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-06_ce6b56bc47d5163607a8aaf6ee60346b_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_ce6b56bc47d5163607a8aaf6ee60346b_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5ED3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5ED3.tmp
Size 1.2MB
SHA256 ae1152b244371ffd5b45570c6e8189d49da24ad5f0c10cbbc7be0505919d5d93
MD5 8cf00f1da3bd3ab45057cd7a427a0f17
SHA1 99e3b13e41b691f3ccb7ee46f5debcf0b8875ac9
SHA512 ef7ae1ed2202e4da22cbdd51a9102dbc1b8276dd34f782efaafa6ab0c9c1dcc5bec8b9d2905cd4461c925e270744459dacb6e3e75f14e861b25816cd59f3d6f2
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORIYA+w3:/6F0eMpAAYEhpYhw
TLSH
T195455C54E783D4F5FD2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 473KB
SHA256 8b042cd8308d448cb7fd047f8c9c6eeed8d05819d5491a2bc8f0f3131702d23d
MD5 a4a3c08b7222f6097a959e79a1e94a52
SHA1 11836df4651bbb606041c6a4472a81c57cb8ba3c
SHA512 57fcceed538c6952be858594a58e6ea80b99af1c2f1cb2869a008197787db56e16f892ab1854f98b99c6c69653b9bd41bed0f132d7bf3c1ac8b9b318fc7d2739
SSDEEP 6144:xLG8Pwq+CO8VkdHMo695FLhsOwrLjkw79NsBk7yxKNeFet1Vp77GkK:BvPkCDV+bm5FLaOwrLjkw7p7IKU8XZK
TLSH
T178A47D56A29800F5D1A7A278C5538A16FBB1781A1761C7CB32BCE7792F236E04E3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 055a7f63821f94b06b1e677a47071ba746ccaf20afeb1742152f31ffeed3397c
MD5 05ed8718fe310d9be229bb09bddc9161
SHA1 1282ff8af4ebc7364b254c53dfd82980011cbeff
SHA512 e5d570c4f6afd34b392e4115b0ff8e989d5cb291fac962661ae6f3c146d183941567054c5245bdb0242642728e779fad161ba500518da9007d36d8d31fd6f75e
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpIYA+w3:/6F0eMpAAYEhpMhw
TLSH
T192455C54E783D4F5FD2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 3c4e95c90d9aa5e05a2a4cc240ec192a5e68590f565a720fa7ca61cfc4b2aa5a
MD5 0481b1c70b4266658df2c207b4242def
SHA1 782fb60f7d7bbe942b4045c3b0958a20f1325d67
SHA512 abee102f0675cf0ec53e4e7b352e4d03ac7fccefde2599ac5a0e33e0c069281963d7c44ff61ceda477e464ecbcb0b78f3f536d4d87522642fb85e2725e1f648c
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOIYA+wb:D6F0eMpAAYEhp7hw
TLSH
T111455C54E783D4F5FD2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 e4097a1d0e0487954103ec221badab1b799760a8f1c1402805d15439b0d3a404
MD5 b38ea1277b6e89accc62f6ce416554fc
SHA1 32436ab028a4ee8a9a3441b33c30f18de27b61eb
SHA512 d9b89a3035a5bb32f13245989a465d88db019773ad634fb38c8db67a855c7146478272d18e04e68bf124ec3df5736f655c5a34f9a4035197adcf7e2c76aea4ac
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcIYA+wh:n6F0eMpAAYEhplhw
TLSH
T139455C54E783D4F5FD2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5564-153-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads