9787bf682d3bbd5f97a2e489127587330500532ddc4dd657d370efe430754f3a

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_5071548a521a069d10da15533927e6c3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.1MB
Sample260916-pvlldaba43
SHA256 9787bf682d3bbd5f97a2e489127587330500532ddc4dd657d370efe430754f3a
MD5 5071548a521a069d10da15533927e6c3
SHA1 3163d8897f1b6b57fa61c944876713957ffff78c
SHA512 db00cda467d3048475be89982e5411c8f5d2fa330e883406b21241010d5cf9fab94f9551e911a345f38fbd930b7b885bc37dcd8835b654a9b0ae4f64116e1ce1
SSDEEP 196608:2Nx8e7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou2gZ2jG:neahvQHrc8u3xXJ/f4uUWHG2y
TLSH
T102079D13B35681E6C02AD2B88A474322E7B9BC440330A7DB16D5BB692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2992	original_temp.exe
2504	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
2504	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_5071548a521a069d10da15533927e6c3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2992	4688	2026-09-16_5071548a521a069d10da15533927e6c3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	83
PID 2992 wrote to memory of 2504	2992	original_temp.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-09-16_5071548a521a069d10da15533927e6c3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_5071548a521a069d10da15533927e6c3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\Temp\{C2D4CDE6-3553-4C41-B4C8-13805A056537}\.cr\original_temp.exe
    "C:\Windows\Temp\{C2D4CDE6-3553-4C41-B4C8-13805A056537}\.cr\original_temp.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.filehandle.attached=564 -burn.filehandle.self=652
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 28807f3b923819c212ae2b65506cafaed05d048f4c8089e61fdd1fbb67abaa28
MD5 edf6d54f95283dd15f8246fabf16b2fd
SHA1 7fd6d466a797c64f008faad5238ce978835efeab
SHA512 846f1459c4d1fb58464242062f99e19a093c2e0b445c72d4890b2f008745b93daf1981875f032003cda8f9cf75617d7df7682484ab897cdd66d0b5c63b566cd9
SSDEEP 24576:H7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPqQcRs47WXnueVulvspdbl:M6F0eMpAAYEhpCqN37WXnu6ulvKdfLMq
TLSH
T160F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 608KB
SHA256 f2f1682d5d6c477ca7caa611b03abca73ae7c8f46994e9c3a2686f29ec53ce52
MD5 67ae6bb9659d3979b63803eaa659a96f
SHA1 533fe84660193d25be749f06b2d15d8543d6b118
SHA512 78d071eae18979e40456ea1d8e8afff62aaefa86da6ecf7415de2bdd7767197fd7439842a3b98a51d0fe2c55fe481318a1457c61615d2d81f6b1c9cc2f8f5457
SSDEEP 12288:amEsd9PZfePv3xl7ft7V+6uC+zd5qLlE13wGKiy7nlEM0Dnmdw:am39PZfePv3r7fm6t+jqp+3l+zCM0D
TLSH
T1A9D47C32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 96beb810ba52079b9c40fe61437b0923fe4fa632550b28a8a974cea40a7f4b15
MD5 00d32ee629c279b6a6300df6a40a98a6
SHA1 a2a57ff4440a4a6f2058cb659319b0f51497914c
SHA512 124b277eecdafb508ec4829e3b8f844fb1d51be26786bef5d4a73a3e797b82d9f470d8f8dbd638ffd4f2475cf96fe6ef5e777dd62081d433ba92e131d4a42a1c
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsiYA+wJl:e6F0eMpAAYEhpDjhwb
TLSH
T1A3455A54E78384F1E93310F0465BE7FBA6349E264031CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5cb7de6f4e1fdad8512ffb88c64106c4c40e53cab7d6b7dcd7f16c9d723d4788
MD5 8cc3696bc974091e5c88ef85e234148e
SHA1 928158ff786e7b7d3c8bedb7f4cb28b68976a0d0
SHA512 faaeb42d38d71f136db75fc55da80459fa6aff8b7df733957d65f06b8f63dff5f9472672776b271743e6dcc2bcc41b01edd2bf71aa17a429e8b7b2380e9be26f
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHiYA+wji:O6F0eMpAAYEhpsjhw2
TLSH
T1E6455A54E78384F1E93310F0465BE7FBA6349E264031CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 32e7c742d00ff7cf5866729116fd3ec608f6621e89d2b79283d07ec4d5a2eb3f
MD5 00ad322aec8f5f3025709369340df492
SHA1 efcb62d51f383de8e9a25d35ad8a5ceb75a7d134
SHA512 471c461963f5254e081c1883a7d66203230607b289ba21db3216f7cc60cf15e17c405c201cf5db9cccec5cf36506bb6244068d750edddf9c74795dee3700a6dd
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpiYA+wJ1:s6F0eMpAAYEhpyjhwr
TLSH
T18F455A54E78384F1E93310F0465BE7FBA6349E168031CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{0EC0178F-F94B-4C19-A0C5-02B81EC9254B}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0EC0178F-F94B-4C19-A0C5-02B81EC9254B}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4688-322-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/4688-324-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads