3b1700aed2f3fac89b4a30ffbdc2956fbfb4dcc3a6384c09ee14b7d34dc61e86

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 3.0MB
Sample260910-ckenvswsbw
SHA256 3b1700aed2f3fac89b4a30ffbdc2956fbfb4dcc3a6384c09ee14b7d34dc61e86
MD5 e3ffd23190c8d634317df5f407777d0b
SHA1 91bebb21f0d573ebeb26e71133f9ec4c18132a99
SHA512 123e18a0e280cfad89088570d6c29bd6c54aead581fc8de66698dd75b888567b79f5071fcbc937cb9a40d9d00d5997efc0d38ba5f80189727fadfc8ca0e4a10c
SSDEEP 49152:r6F0eMpAAYEhpJhw36KSyBpFTN01vparjzGrF:60nAAYEpJhm69EN01vArjKh
TLSH
T11CE5C477B287D4E5D81E50B0CF165FF551606C7DC6E28B9B62CCBE20BB3299035AA20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2360	4868	2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_e3ffd23190c8d634317df5f407777d0b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 c8180785af2999c9be961227a72dd515658f203fa4456000b446957f60263ee6
MD5 348d7f5a1350bbcd8293363fec0983b3
SHA1 862c8280e6416f7f17cae2e4eb2a3a54816c2fa3
SHA512 7ee801fd4f73aba6c15588eb7fe99d8dfdaedca33a51ee36ba2971ad0a11d8e30d2b8cdb63efcd714f3e5d309731a809252b9c4cee55b14fbf28d15f44e01c87
SSDEEP 393216:4ylw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vX3:4uWO1c877xqpyovvVWJ6VFK+q3cSvX3
TLSH
T1205712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4CE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4CE1.tmp
Size 1.2MB
SHA256 6bdf04dfc683a9d8564cf6d5768a4041a4e2b5c636a4ec11cb2186ca34367222
MD5 92cb47173fda1a689ddab28c78127fbf
SHA1 b36d3cf81c1cfa7c8a86098ee66a123367f7725d
SHA512 abb8fcf2ba0ba322e3f4c7dbaaca0d34e179d03026e9aed8df5e496f8481915ef45834ff5f4b59085ed0089be445f7517f1618e7ff8876fd1c26acb10ad01f75
SSDEEP 24576:P7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUYA+wAJ:06F0eMpAAYEhpahw4
TLSH
T1FB455B54E683C6F3E92310F0854BE7FBA5309E15C0318D6BFBC8FE01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 1.5MB
SHA256 eb6a6924e06cbfc84deb93aaab6d2686d20d69e31f9e920a41b07f7689800078
MD5 627c5c8759c437f7421aff3f992870e6
SHA1 715be9b9ab1fface88c580701e4241a055ac27fb
SHA512 d29a5a22a93802a596f8f02b7e854c170e2370942b8be5446fb7da1e641ae54a5cdbc067ba53ef60da8db8d70b011321df8014701f133652855f84110fa2d847
SSDEEP 12288:ebduF/94sevdp0jHNvTwhiFTEIKcu2m1v7rhsvxrdTdPMuhoV/NKrqSZp0vyoNSq:udY4jyB8iFTEIK5L1vpsvxrdp05K9or
TLSH
T1E57590377297D0D4C41D90B4CF160AF195A17CA9C7E59BDB01CCBE24BB32AD07ABA609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 8738a12348a8f10d1e6a70f13a27604b49efe0eebe01b5e84862fbaa4f289d1c
MD5 60433d72bd9f6d6dd64e0aa6d5a54238
SHA1 3c73a156f06757e6e59662bdb480c88394164d3b
SHA512 c4c57c1a07e08935d921100f462d80cea7952740909daf5b043f228348c98949e03f2c368a937656e61e5e6a59d3b9f13080e3712ddf121a74c1a3e1581d16bd
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wtd:r6F0eMpAAYEhpJhw3
TLSH
T194658F76B687D5F2D81A14B0CF0AABF651604D7DC0E28B1BB6C9FE21FB7195130E610A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 b455c22e7ce1bba6eadd3b3be990d97fd82c9bd3c08f705ddec6e4243e7e95ec
MD5 4e4376f83f2a68d0d5980cd863e30d2a
SHA1 241ec35937b1d120294169c391fd737a18489c7e
SHA512 d00a92527a0f4f0f4e59d54d73e70dd76cea25509839ed45fdbe16b9a0c1c1b38c3b6ebbfa66f6b14b9c3fc1e70fc636df068cfd4e9d8aca90941ac3a3932bbf
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4YA+wYk:76F0eMpAAYEhpKhwJ
TLSH
T1B0658F76B687D5F2D81A14B0CF0AABF651604D7DC0E28B1BB6C9FE21FB7195130E610A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4868-152-0x0000000000400000-0x0000000000577000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads