7e4fe2355be32c4dc8cbd5a8ed609e0ef8dafa245882114f439ea0c50e80f784

General

Target
2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.9MB
Sample260907-er17jscl5v
SHA256 7e4fe2355be32c4dc8cbd5a8ed609e0ef8dafa245882114f439ea0c50e80f784
MD5 463fe0f59a18a1954e816b12252ffc9c
SHA1 9cff1db952129c81512d712f7725d77caadfe8a7
SHA512 51bde4d0664262d6e4ddc30a7e4fd8d6a290da21532b82b72b2bd9d10ea610b2dcb92977dd24072fbd6d0de1fdda6caa648452b007bada057feb38231c03b245
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+wv9FLxIG8vMOWi7Yb:A6F0eMpAAYEhpbhhwVsGSMpCm9
TLSH
T160958D40DB8684F6EC3345B0C057E7FA9A31BE554071CF6BA2C8FE25BD72A416826736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2492	2240	2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 c79bb585f80f048b9218586898f982e938062535bcd35358ca304bd94efaf009
MD5 dec191448965b2dda042063e63183390
SHA1 cb8db0de966b874a19f61f13072a917b73b68759
SHA512 530551332545e8e233a4e1a64558a4b311f68ead73fe6fb58685bccd4a6182c0f73fef0ca89ea05df9ece962c7893f73a87033abb7defae5e093c80d0c48128e
SSDEEP 393216:S2lw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXR:SqWO1c877xqpyovvVWJ6VFK+q3cSvXR
TLSH
T1975712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX470.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX470.tmp
Size 1.3MB
SHA256 9e302b5f11f5fa8b70858c6cf1623d632fbf45b3453e3d7036af1f356eb8d10a
MD5 8d9678a53195224aa665bf161f150e12
SHA1 0e5e1a049d5ddff9b60178cf9395a56e6fed8982
SHA512 7ee224c4106d3e77757b9f97837016fadce585bee9185bbea7dbea63c3a0660cceb92088cc809959b875566f32580dde38e5188026f4017e1fc880c5b85e18af
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+wv9:A6F0eMpAAYEhpbhhwV
TLSH
T11C556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX85A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX85A.tmp
Size 1.3MB
SHA256 89ffa5047c8ac380f09a2530a274ab2e0440dace72500c3de4d1c9ab82093c48
MD5 b6744285f519140925bb31eb70b11a4f
SHA1 2cfd4c5355708f756481697316d8be25c8847dab
SHA512 c7575770a3aa2e9ca1374a191942ed116e2157b7b4fe00e6c8a565f72b0ec231a84376decfb0ff0bfc29c24be39facd3646fdfbb6f0ba00f4514536a787d0120
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOFwYA+w9T:o6F0eMpAAYEhpmhhwN
TLSH
T13E556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX86B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX86B.tmp
Size 1.3MB
SHA256 a81933353a2e274651a13a9e3909fe37e9e740ea719feff9b9363d7e5b82bee6
MD5 18a0d3817f52da50f2569e7c75f344b6
SHA1 709305a1c844dae1ce2e4f6eca1a5baa5bd23961
SHA512 e3f11d28bf0108cf97a8d8a56be85ab36dafcfb969eefadc47a95855008080a45b76c2137777ba21b5a42e267e4cbcb778bf5c6d0dae81c389bce0d5d6d95a29
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfwYA+wvY:w6F0eMpAAYEhpMhhwQ
TLSH
T11E556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 598KB
SHA256 f4ba4558f793804a6ef27a3e48b994eaf09dc323fb2df65e1db7bf6078f67b72
MD5 ea277db86f777d1f34d5376d1c92bdfe
SHA1 3527a10584db472c788996170236a54950a332c8
SHA512 3ff2378f854ee22766585137150639cdb01dc8426fffc920084bdda75e29294ad5048d69979b8ac8978586fc5087a7a784adcc322ee0713b7c9f0191b8f48796
SSDEEP 6144:BLJ9snIL+1FGbAVNMonD32nVi18leXM1c0tPvmiTVVmVVV8VVNVVVcVVVxVVVPVg:BLJ9sIIG8vMoDWiae56NAsG6
TLSH
T19FD47D42DF8800EBD8779A30D5719655CB77BCD46AA4DB9F12A83D3E3E266808C36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2240-252-0x0000000000400000-0x0000000000550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads