73fba25d6e684212e6f270cf5181df4b804c485aa8d2c4c34503e0d5fef536d8

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.1MB
Sample260926-2ekqcsvxdx
SHA256 73fba25d6e684212e6f270cf5181df4b804c485aa8d2c4c34503e0d5fef536d8
MD5 57e54aa6ea0549c63fa0d774c940e2b9
SHA1 b7e55976f00e32e44d3738eda1692b302a28fb2d
SHA512 a0aff782535981c409e47bc85e20e6ca738ddb54b69a37b6fcae65ea64e5544b568df00856184ab0cd1a19c9929d2aecae1c095d2194ade484d1044679320235
SSDEEP 196608:LN1e7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouCgZ2ji:XeahvQHrc8u3xXJ/f4uUWHi2W
TLSH
T105079D13B35681E6C02AD2B88A474322E7B9BC440334A7DB16D5BB692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4796	original_temp.exe
3120	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
3120	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4796	3752	2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	94
PID 4796 wrote to memory of 3120	4796	original_temp.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\Temp\{E31B9614-852F-49ED-AD43-E2194A751C11}\.cr\original_temp.exe
    "C:\Windows\Temp\{E31B9614-852F-49ED-AD43-E2194A751C11}\.cr\original_temp.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.filehandle.attached=556 -burn.filehandle.self=704
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 e71cfae275d0cf7cdd32b4f96d65a19c97b8200b24352820b367039f78073b3c
MD5 89f8596802cd40a79ee7849cc419613a
SHA1 c27e724a3835511da3808e39f8bc72d23c8952bd
SHA512 9779cca8c2485ad300d7a91cddfb36208370ae92ce1fdffb81031cfce0c7345d96d2a60b84e00cc8c1531a1cbce59f1455446d4a88c102ca1c62a5a9a5f02ce1
SSDEEP 393216:IAlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXR:IMWO1c877xqpyovvVWJ6VFK+q3cSvXR
TLSH
T18F5712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX87E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX87E8.tmp
Size 1.2MB
SHA256 ed9a9b8fd75fd711156b0d2cd820d94f6573402d36e7c13dce569c06ed7a46b2
MD5 a591456102fd22a3dc132d340b4a651f
SHA1 1abb86715b10782859b965fa624990aa6302d69d
SHA512 7f34066327cdf90ee362bc41bb9701dece32dac61e0eaaabde3326b5a92e91aae73111c793e7cf9c45c393a5b2879a9372b3096419a000977ecabb34be071352
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIIYA+wJo:/6F0eMpAAYEhpFhw+
TLSH
T1C7456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX8F8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX8F8E.tmp
Size 1.2MB
SHA256 310df1343b793daca517ff6e39f7849d7febb7202055e88392e3db477799975e
MD5 7848b6f85eedd7dbf1393cb5fd1be3f6
SHA1 e289084f02033ae685169eb13e4be2515ddeee79
SHA512 dfdb4e009aabb770f1b3feea592fe7b12f15b1406c6837981a48f432cf82d8b51d0c1f3d5ebb778ccd3e88f87dd63d6aa4611bfa2808b47e1620b1b972d3fff5
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBIYA+wJg:/6F0eMpAAYEhp4hw2
TLSH
T199456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 608KB
SHA256 f2f1682d5d6c477ca7caa611b03abca73ae7c8f46994e9c3a2686f29ec53ce52
MD5 67ae6bb9659d3979b63803eaa659a96f
SHA1 533fe84660193d25be749f06b2d15d8543d6b118
SHA512 78d071eae18979e40456ea1d8e8afff62aaefa86da6ecf7415de2bdd7767197fd7439842a3b98a51d0fe2c55fe481318a1457c61615d2d81f6b1c9cc2f8f5457
SSDEEP 12288:amEsd9PZfePv3xl7ft7V+6uC+zd5qLlE13wGKiy7nlEM0Dnmdw:am39PZfePv3r7fm6t+jqp+3l+zCM0D
TLSH
T1A9D47C32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 17d123852ef9103d3ede3db6475e0f0e37794f683928d0c7865ed59c6e197325
MD5 88953c5c9b4c76acb6d86b1e910f465f
SHA1 51c808a07415ff2e8733cb63f1ac4f5b89fc96c5
SHA512 abfa1fe80631c83718f38f8d4c8688fc01555c543d99302ca5aa3ecc634eeec92430721a759126d7125a53da093ed844a34724e3b3213392fc36f6cd46277920
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyIYA+wpG:H6F0eMpAAYEhpnhwE
TLSH
T1ED456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{99EB8016-9AB8-4241-94DC-2E3CCE7900FC}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{99EB8016-9AB8-4241-94DC-2E3CCE7900FC}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3752-336-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3752-338-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads