a74f141120cfadd45586d70dde08709847b41a3693766026421a65b8d4169951

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
Size 1.7MB
Sample260906-ycsfmsyzfx
SHA256 a74f141120cfadd45586d70dde08709847b41a3693766026421a65b8d4169951
MD5 b62dee1b4997a01cba709f6f55f5201c
SHA1 428637b23cbc20cc40e806072d8854b55264487e
SHA512 9d3111b2865aa5e474af0c09bf3c157408e3e0649eed2ad88fddc1a14ed7762a17dc72d1a11acda43709c658c283701271ffa399cf8131bf06beb2e407f33e0c
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdwYA+wqfu8Vllg8tlS:g6F0eMpAAYEhp+hhwsnq8tlS
TLSH
T1A8858D90DB8784F6EC3305B0C057E7FA5632AE558061CE6BA2CCFE15BDB2E416826735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4176	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 4176	5220	2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_b62dee1b4997a01cba709f6f55f5201c_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4E97.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4E97.tmp
Size 1.3MB
SHA256 9b68cb079d8c4798c2c2c962946787200e5a291d59e3c428075505d865e87250
MD5 3feb2f2e7c8c8246b38450ad023e49a0
SHA1 f071c8163d714253ccb9c2c9fcfb5d77c7a1076e
SHA512 b99e4f937d41be413c2706e73145f0bc69bb9123e8f07910826df45ccfe89cc48f83705537300d7487a5da68095a17a6dabb65913a3b3743b548623991e74910
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+wDa:Q6F0eMpAAYEhprhhwO
TLSH
T1D3556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 425KB
SHA256 fd2abf44f50bcf46f6fbb54e89b44e1c7a1a24ae5e55f89e749ff9a839a03c59
MD5 3fad75df67f65173a0d2b21f0977a00b
SHA1 12d4677d0daee17cc0fc69ed4034dfb1875a4c42
SHA512 edb0c24026cd0a64dc91b37d2622f3c11e667855e32566e15c9cfa11311063b949188b88455a51a78df9c64ba532a57c9eeb1e4039b5183d9b3693292a7638ac
SSDEEP 6144:Zs8VxbvEYEoQV6tovwmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVL+:Zs8VxjEYgV6toK3s
TLSH
T118943B41EB8804DBEC329A30D170A7599B37F8D0AB95CF9E116C3E3DBC666409C26779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 d8065d289bb2a27f6cc70c8705ad8f44e9157863d87b3eb085039e759973ee9e
MD5 42b0c768f8fbd701a4a1e24224322706
SHA1 8e57265353db0a5940167613ba62ec55d5294773
SHA512 27fca8cf5ae00865da91b93ed9002aa5b9c08bdc472cbe15bafabd5d90b2602e17cb282eae1ad1090731e4ecb5cef443dba48cfa9381da711610f47d2bc06d02
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdwYA+wqf:g6F0eMpAAYEhp+hhws
TLSH
T1C5556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 1cba04400784ced40b03df34da0b00a0ed203f0f7fd3174fc3015ffe30b44f76
MD5 42aed2fd334ef51431ab4f6f3eae0dda
SHA1 1ae10573077e4239b6462e2867b464c2621d3743
SHA512 b660797dbbfbd6c14bcbcc0277497b8a451ced9e9c2d7680ebaa7d71e8a07702abdb5c2d4fba6edaba01ea93be7f17619f4dfd20c62079791eb68cb7a81bfa35
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdwYA+wm8:w6F0eMpAAYEhpyhhw/
TLSH
T128556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 7a7cf9d0312c335e8ad453144c2b093bf4691fc48ddf2d9c10247b3c542b7177
MD5 045741e4f0ab1b591edd669278783203
SHA1 dba6e6ba2294885523b6b048c771d1301bc65061
SHA512 b768619ee178ccbcc97775b08f42f305ee1f97271579db0f1ab6aae76ea014dc316c16cb1728d58bfaa2cd22778a95aa6e1d3e4bbcbf508360c5c8412dac0f15
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIwYA+wDp:86F0eMpAAYEhpDhhwN
TLSH
T1F8556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5220-151-0x0000000000400000-0x0000000000550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads