7e4fe2355be32c4dc8cbd5a8ed609e0ef8dafa245882114f439ea0c50e80f784

General

Target
2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.9MB
Sample260907-er17jscl5v
SHA256 7e4fe2355be32c4dc8cbd5a8ed609e0ef8dafa245882114f439ea0c50e80f784
MD5 463fe0f59a18a1954e816b12252ffc9c
SHA1 9cff1db952129c81512d712f7725d77caadfe8a7
SHA512 51bde4d0664262d6e4ddc30a7e4fd8d6a290da21532b82b72b2bd9d10ea610b2dcb92977dd24072fbd6d0de1fdda6caa648452b007bada057feb38231c03b245
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+wv9FLxIG8vMOWi7Yb:A6F0eMpAAYEhpbhhwVsGSMpCm9
TLSH
T160958D40DB8684F6EC3345B0C057E7FA9A31BE554071CF6BA2C8FE25BD72A416826736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5956	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 5956	1508	2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_463fe0f59a18a1954e816b12252ffc9c_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 b8b58e1f1fa1dc9acd84cd5cfb3d74be344bc2009b6f50d2852a615eb7c4bb04
MD5 8dff797822219e4e65f74750b83f0753
SHA1 72e64085c60b44fcab2aa4e9c47c82a49c36132c
SHA512 4dc2fd033b1d12bc12169527befca9cac4a5a5a6fd6eb7b9fca82afc054bb53345719ff1c9e6b026cd772fdab5cc1e0b29c6bc73db8af5ab372e7d0905ac63d3
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4wYA+wvg83npi63i5:D6F0eMpAAYEhpjhhwY8XpiM8
TLSH
T1CE857C50E7C780B5F97316B0856BE7BA5631BD218831CE2FA3C8EE09BDB1941A535723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3487.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3487.tmp
Size 1.3MB
SHA256 b6d7396dfe326ed1e537fd091eb31ee2f04ef3161d789a9868a3ea67c9d2125b
MD5 f0405843100edee030bc26926ae06f80
SHA1 c4dd3769e9808fabc4a282545e1c8faad10284b5
SHA512 433bbfa0ec76459ca496ba600ccc0babca1f8251363863243f247c0bdbb416be1111a80c37d52fc8298bd3c0cccac79c28a7c71646e2e1badcd5b7812a978303
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+w9N:A6F0eMpAAYEhpLhhwf
TLSH
T187556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 598KB
SHA256 f4ba4558f793804a6ef27a3e48b994eaf09dc323fb2df65e1db7bf6078f67b72
MD5 ea277db86f777d1f34d5376d1c92bdfe
SHA1 3527a10584db472c788996170236a54950a332c8
SHA512 3ff2378f854ee22766585137150639cdb01dc8426fffc920084bdda75e29294ad5048d69979b8ac8978586fc5087a7a784adcc322ee0713b7c9f0191b8f48796
SSDEEP 6144:BLJ9snIL+1FGbAVNMonD32nVi18leXM1c0tPvmiTVVmVVV8VVNVVVcVVVxVVVPVg:BLJ9sIIG8vMoDWiae56NAsG6
TLSH
T19FD47D42DF8800EBD8779A30D5719655CB77BCD46AA4DB9F12A83D3E3E266808C36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 9e302b5f11f5fa8b70858c6cf1623d632fbf45b3453e3d7036af1f356eb8d10a
MD5 8d9678a53195224aa665bf161f150e12
SHA1 0e5e1a049d5ddff9b60178cf9395a56e6fed8982
SHA512 7ee224c4106d3e77757b9f97837016fadce585bee9185bbea7dbea63c3a0660cceb92088cc809959b875566f32580dde38e5188026f4017e1fc880c5b85e18af
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcwYA+wv9:A6F0eMpAAYEhpbhhwV
TLSH
T11C556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 00cbebaa65b3b161cfaa93b5ed91818270d6995ffb6848e4f0b874f00740b445
MD5 f0cf9be90e77ad7ddc437c52a4debed3
SHA1 a3134e225a42eaddea3749cb8906b5517aa86c7d
SHA512 61e9b4e0e0587f24dec368323895f35f0356148d24e0ab94a8651f5d02cf7af63daea080fe874d7b0f62f84249ad856a77c47e67749c2b1c74a977aa0fc7b0ff
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgwYA+waP:86F0eMpAAYEhpPhhwM
TLSH
T119556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 89ffa5047c8ac380f09a2530a274ab2e0440dace72500c3de4d1c9ab82093c48
MD5 b6744285f519140925bb31eb70b11a4f
SHA1 2cfd4c5355708f756481697316d8be25c8847dab
SHA512 c7575770a3aa2e9ca1374a191942ed116e2157b7b4fe00e6c8a565f72b0ec231a84376decfb0ff0bfc29c24be39facd3646fdfbb6f0ba00f4514536a787d0120
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOFwYA+w9T:o6F0eMpAAYEhpmhhwN
TLSH
T13E556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.3MB
SHA256 ad33575dbcf51e5b11bf5166d0108be391b7904baa69dd488c0d352ce080af41
MD5 0fbc9be7e3772e13e6fe8040ef25f7d5
SHA1 f256be0925923cd8d18cd50959c036c91e5e8af6
SHA512 e1847689fce2d9a58a49dca95b92c5aa1ca0bb6d94f9abe516bc400274db59d07a679194b4ee4cf56cf40dafe68bb5dd91234cf1abc7ac07338c44817f86ea57
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOywYA+w7i:w6F0eMpAAYEhpBhhwO
TLSH
T124556C90DB8384F6EC2315F0804BE7FB56309E1580718E7BF6C8FE15BDB2E526529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-153-0x0000000000400000-0x0000000000550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads