a74f141120cfadd45586d70dde08709847b41a3693766026421a65b8d4169951

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
Size 1.7MB
Sample260906-ycsfmsyzfx
SHA256 a74f141120cfadd45586d70dde08709847b41a3693766026421a65b8d4169951
MD5 b62dee1b4997a01cba709f6f55f5201c
SHA1 428637b23cbc20cc40e806072d8854b55264487e
SHA512 9d3111b2865aa5e474af0c09bf3c157408e3e0649eed2ad88fddc1a14ed7762a17dc72d1a11acda43709c658c283701271ffa399cf8131bf06beb2e407f33e0c
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdwYA+wqfu8Vllg8tlS:g6F0eMpAAYEhp+hhwsnq8tlS
TLSH
T1A8858D90DB8784F6EC3305B0C057E7FA5632AE558061CE6BA2CCFE15BDB2E416826735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2988	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2988	4692	2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 da26d57fdfe3a3ea6edff2d687222f610c1d979833f2c960fa01e2440780c98a
MD5 5fc3574371de7acb17c6cc4b320472d2
SHA1 6d084bfe6de2a6b1ace3262b245676efe910874e
SHA512 59e9bb070d108141bc1610a85ae5b10e0a3d0cad40d573658ffea91394963b646a06fc993fad9e5b8c8acec6a5d0c3f7d0ce3402b1173b20eafbd66b900b4f29
SSDEEP 24576:f7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODqTcRs47WXnueVulvspdbl:k6F0eMpAAYEhp2qA37WXnu6ulvKdfLMq
TLSH
T173F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX54B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX54B3.tmp
Size 1.3MB
SHA256 d8065d289bb2a27f6cc70c8705ad8f44e9157863d87b3eb085039e759973ee9e
MD5 42b0c768f8fbd701a4a1e24224322706
SHA1 8e57265353db0a5940167613ba62ec55d5294773
SHA512 27fca8cf5ae00865da91b93ed9002aa5b9c08bdc472cbe15bafabd5d90b2602e17cb282eae1ad1090731e4ecb5cef443dba48cfa9381da711610f47d2bc06d02
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdwYA+wqf:g6F0eMpAAYEhp+hhws
TLSH
T1C5556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5794.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5794.tmp
Size 1.3MB
SHA256 591d85c3e2844701f90a63fde206534db257b713de71865d3c565d0add89bcf9
MD5 2090c604e4a525a34e1208fbd5ae3af5
SHA1 a2f73bc674cbecc89131ad4fdfee15d2ef884b59
SHA512 bdafeb7effeed809ecd1c724df0c0b139d960f1e067c47c2ed19e1dc4dee9cc234078b98e8a9ed40f3bb1ab8d4a55c840e25d536945d302959326679d43d327a
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+wqa:Q6F0eMpAAYEhprhhwZ
TLSH
T117556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 425KB
SHA256 fd2abf44f50bcf46f6fbb54e89b44e1c7a1a24ae5e55f89e749ff9a839a03c59
MD5 3fad75df67f65173a0d2b21f0977a00b
SHA1 12d4677d0daee17cc0fc69ed4034dfb1875a4c42
SHA512 edb0c24026cd0a64dc91b37d2622f3c11e667855e32566e15c9cfa11311063b949188b88455a51a78df9c64ba532a57c9eeb1e4039b5183d9b3693292a7638ac
SSDEEP 6144:Zs8VxbvEYEoQV6tovwmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVL+:Zs8VxjEYgV6toK3s
TLSH
T118943B41EB8804DBEC329A30D170A7599B37F8D0AB95CF9E116C3E3DBC666409C26779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4692-259-0x0000000000400000-0x0000000000550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads