73fba25d6e684212e6f270cf5181df4b804c485aa8d2c4c34503e0d5fef536d8

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.1MB
Sample260926-2ekqcsvxdx
SHA256 73fba25d6e684212e6f270cf5181df4b804c485aa8d2c4c34503e0d5fef536d8
MD5 57e54aa6ea0549c63fa0d774c940e2b9
SHA1 b7e55976f00e32e44d3738eda1692b302a28fb2d
SHA512 a0aff782535981c409e47bc85e20e6ca738ddb54b69a37b6fcae65ea64e5544b568df00856184ab0cd1a19c9929d2aecae1c095d2194ade484d1044679320235
SSDEEP 196608:LN1e7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouCgZ2ji:XeahvQHrc8u3xXJ/f4uUWHi2W
TLSH
T105079D13B35681E6C02AD2B88A474322E7B9BC440334A7DB16D5BB692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5392	original_temp.exe
5508	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
5508	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 5392	5876	2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	90
PID 5392 wrote to memory of 5508	5392	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_57e54aa6ea0549c63fa0d774c940e2b9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\Temp\{91E71383-D439-4216-86C6-FF649BFE3231}\.cr\original_temp.exe
    "C:\Windows\Temp\{91E71383-D439-4216-86C6-FF649BFE3231}\.cr\original_temp.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.filehandle.attached=768 -burn.filehandle.self=568
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXD0CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXD0CC.tmp
Size 1.2MB
SHA256 f48221e9197fae1a3f71a807de6d67cf3a88fee05244e9ecdf4f2b088b91e71d
MD5 e2c59f8cdeb6ae2982ae1751818e1b5a
SHA1 aabea9676cee346c5f5df87f3f24f7a83ddb95c9
SHA512 17f61260504810bb157e603ca22ecc28be18ecfa27c6227c0c7edc91d4ddbecae6dee20a2ae8e91115c21467b6eefe0ace9df723e8ede6c68418f43f73773f82
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOiIYA+wpu:36F0eMpAAYEhpfhwM
TLSH
T14F456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 608KB
SHA256 f2f1682d5d6c477ca7caa611b03abca73ae7c8f46994e9c3a2686f29ec53ce52
MD5 67ae6bb9659d3979b63803eaa659a96f
SHA1 533fe84660193d25be749f06b2d15d8543d6b118
SHA512 78d071eae18979e40456ea1d8e8afff62aaefa86da6ecf7415de2bdd7767197fd7439842a3b98a51d0fe2c55fe481318a1457c61615d2d81f6b1c9cc2f8f5457
SSDEEP 12288:amEsd9PZfePv3xl7ft7V+6uC+zd5qLlE13wGKiy7nlEM0Dnmdw:am39PZfePv3r7fm6t+jqp+3l+zCM0D
TLSH
T1A9D47C32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ed9a9b8fd75fd711156b0d2cd820d94f6573402d36e7c13dce569c06ed7a46b2
MD5 a591456102fd22a3dc132d340b4a651f
SHA1 1abb86715b10782859b965fa624990aa6302d69d
SHA512 7f34066327cdf90ee362bc41bb9701dece32dac61e0eaaabde3326b5a92e91aae73111c793e7cf9c45c393a5b2879a9372b3096419a000977ecabb34be071352
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIIYA+wJo:/6F0eMpAAYEhpFhw+
TLSH
T1C7456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 59f4584a8e34e91a78958a2d40d8d86433ee57ce686404675f4c7616e07fd1ad
MD5 3f8e42f4f92413ff5c77e64208d722a0
SHA1 b3444b23bdd297d5a55008bfc4d2a92bd816959c
SHA512 4a8b86a594de60e13a824f6847df9f60e2596e55644cc99b634bfc2f65f7dfb1111c5cfc83087e336c08d9f692e9dc9274686ea80127f830fb61986911dd79a1
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzIYA+wgw:z6F0eMpAAYEhp+hwF
TLSH
T128456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 17d123852ef9103d3ede3db6475e0f0e37794f683928d0c7865ed59c6e197325
MD5 88953c5c9b4c76acb6d86b1e910f465f
SHA1 51c808a07415ff2e8733cb63f1ac4f5b89fc96c5
SHA512 abfa1fe80631c83718f38f8d4c8688fc01555c543d99302ca5aa3ecc634eeec92430721a759126d7125a53da093ed844a34724e3b3213392fc36f6cd46277920
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyIYA+wpG:H6F0eMpAAYEhpnhwE
TLSH
T1ED456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{27C3A72E-8312-4156-9A59-81AE6729CD45}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{27C3A72E-8312-4156-9A59-81AE6729CD45}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5876-214-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/5876-216-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads