3b1700aed2f3fac89b4a30ffbdc2956fbfb4dcc3a6384c09ee14b7d34dc61e86

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 3.0MB
Sample260910-ckenvswsbw
SHA256 3b1700aed2f3fac89b4a30ffbdc2956fbfb4dcc3a6384c09ee14b7d34dc61e86
MD5 e3ffd23190c8d634317df5f407777d0b
SHA1 91bebb21f0d573ebeb26e71133f9ec4c18132a99
SHA512 123e18a0e280cfad89088570d6c29bd6c54aead581fc8de66698dd75b888567b79f5071fcbc937cb9a40d9d00d5997efc0d38ba5f80189727fadfc8ca0e4a10c
SSDEEP 49152:r6F0eMpAAYEhpJhw36KSyBpFTN01vparjzGrF:60nAAYEpJhm69EN01vArjKh
TLSH
T11CE5C477B287D4E5D81E50B0CF165FF551606C7DC6E28B9B62CCBE20BB3299035AA20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2664	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2664	996	2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4380.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4380.tmp
Size 1.2MB
SHA256 6bdf04dfc683a9d8564cf6d5768a4041a4e2b5c636a4ec11cb2186ca34367222
MD5 92cb47173fda1a689ddab28c78127fbf
SHA1 b36d3cf81c1cfa7c8a86098ee66a123367f7725d
SHA512 abb8fcf2ba0ba322e3f4c7dbaaca0d34e179d03026e9aed8df5e496f8481915ef45834ff5f4b59085ed0089be445f7517f1618e7ff8876fd1c26acb10ad01f75
SSDEEP 24576:P7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUYA+wAJ:06F0eMpAAYEhpahw4
TLSH
T1FB455B54E683C6F3E92310F0854BE7FBA5309E15C0318D6BFBC8FE01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 1.5MB
SHA256 eb6a6924e06cbfc84deb93aaab6d2686d20d69e31f9e920a41b07f7689800078
MD5 627c5c8759c437f7421aff3f992870e6
SHA1 715be9b9ab1fface88c580701e4241a055ac27fb
SHA512 d29a5a22a93802a596f8f02b7e854c170e2370942b8be5446fb7da1e641ae54a5cdbc067ba53ef60da8db8d70b011321df8014701f133652855f84110fa2d847
SSDEEP 12288:ebduF/94sevdp0jHNvTwhiFTEIKcu2m1v7rhsvxrdTdPMuhoV/NKrqSZp0vyoNSq:udY4jyB8iFTEIK5L1vpsvxrdp05K9or
TLSH
T1E57590377297D0D4C41D90B4CF160AF195A17CA9C7E59BDB01CCBE24BB32AD07ABA609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 8738a12348a8f10d1e6a70f13a27604b49efe0eebe01b5e84862fbaa4f289d1c
MD5 60433d72bd9f6d6dd64e0aa6d5a54238
SHA1 3c73a156f06757e6e59662bdb480c88394164d3b
SHA512 c4c57c1a07e08935d921100f462d80cea7952740909daf5b043f228348c98949e03f2c368a937656e61e5e6a59d3b9f13080e3712ddf121a74c1a3e1581d16bd
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wtd:r6F0eMpAAYEhpJhw3
TLSH
T194658F76B687D5F2D81A14B0CF0AABF651604D7DC0E28B1BB6C9FE21FB7195130E610A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-273-0x0000000000400000-0x0000000000577000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads