bb034293932548ea8fdc921a8b4bf4b0a8ced49044f91bb0ef1993b22f5cbe54

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_f7219f5494dfeb9f1d59f62ce5cab9c1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.1MB
Sample260929-qv6f8a1eme
SHA256 bb034293932548ea8fdc921a8b4bf4b0a8ced49044f91bb0ef1993b22f5cbe54
MD5 f7219f5494dfeb9f1d59f62ce5cab9c1
SHA1 03134f44fc00f4e74a9ab86f18c72db90fdc5534
SHA512 ba814e4defa93b95f943969982a73067e538a44d88f0e40a76602c3e5b5df58635526a7b69ef6aea9ac83115381b0cfb4b20121186ef7a9bde32fb4ce75ec3ff
SSDEEP 196608:XNr7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouNRjS:VahvQHrc8u3xXJ/f4uUWHMS
TLSH
T15B079D13B35681E6C02AD2B88A474322E7B9BC440334A7DB16D5BB692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5844	original_temp.exe
4340	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
4340	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_f7219f5494dfeb9f1d59f62ce5cab9c1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5844	3028	2026-09-29_f7219f5494dfeb9f1d59f62ce5cab9c1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	90
PID 5844 wrote to memory of 4340	5844	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-29_f7219f5494dfeb9f1d59f62ce5cab9c1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_f7219f5494dfeb9f1d59f62ce5cab9c1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\Temp\{6EC4A738-269C-4C0E-B802-A96BFC988E32}\.cr\original_temp.exe
    "C:\Windows\Temp\{6EC4A738-269C-4C0E-B802-A96BFC988E32}\.cr\original_temp.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX1A48.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1A48.tmp
Size 1.2MB
SHA256 6ffc8df8541358437a43968600eb876f383836e99744dfda9211c0a8f45da42b
MD5 0d914e907117624e931867654e73422a
SHA1 c887ef6350ca3c6e63038d2cf1dc7e4cc79501ba
SHA512 66a6d9ce3290c8a98c5a2a36554cc7287cf2f076718b4b33d8336aa6e54d8ff02d14d4e89e5c2fabaa4ef51e967e4d1e4147cdcaa960786ca473b4b98a6ebd1a
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnIYA+wt:T6F0eMpAAYEhpShw
TLSH
T10B455D54E783D4F5FD2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 634KB
SHA256 54fbe7fdf0fd2e95c38822074e77907e6a3c8726e4ab38d2222deeffa6c0ccaf
MD5 3cfb3ae4a227ece66ce051e42cc2df00
SHA1 0a2bb202c5ce2aa8f5cda30676aece9a489fd725
SHA512 60d808d08afd4920583e540c3740d71e4f9dc5b16a0696537fea243cb8a79fb1df36004f560742a541761b0378bf0b5bc5be88569cd828a11afe9c3d61d9d4f1
SSDEEP 12288:3nMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:3MysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T151D49E3294614036E6F206B3B918A2347D7CE21827148DAEE3E8ED5D7EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 cea0824202d1991395fd72a18d85971cdeecfbe5eabe1074e809f8f5719500f2
MD5 2496be43eb4a19f5cf16ad7875ee76ce
SHA1 134db713ba6ed3c5c15fe8ba03aef03a561f26c0
SHA512 73e43ff5646ca57eed17b8488c79fbf140046ddaa9dc475e42f6081da699257312ab3f6b13f87e8c85220300b4d335a9a29f5d49276728e9841a6c7dab30b8f5
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjIYA+wo:j6F0eMpAAYEhp2hw
TLSH
T12B455C94E783D4F5FD2314F0444BE7FBA5309E2A40318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 df4a68f9b67da88e74b636f1ea151c634487ee4edaab549f9c695fa6a89769fa
MD5 4a64bf8adfa753f9a1532d71990caf27
SHA1 f0a90601af5f1e4f4fdd72206bca02cb2bd15f75
SHA512 edf3e275ee763206e266fa9d82aa8bf36a142b37ce9c957d430daaf31fc7f06b363b0653fea0fea8a7cc37f8dae34849b9fcebbf4139a99b67405afe05ac7d3a
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOFIYA+wa:D6F0eMpAAYEhpUhw
TLSH
T148455C94E783D4F5FD2314F0444BE7FBA5309E2A40318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 c032752b4afa02a84b6c3d86a3be35c2985b32f15bf4ca3f6c4da25ae991e9c1
MD5 86b0d14443ceac74b1ed447c84902e46
SHA1 c0ac8f04b4a2d1236d078bffe036643469f1e519
SHA512 cfa8543861a6ffbb09440d94a2fd6b9b54d85cbaffbd476fbac166a5cbaa744e0e337e05a0daf1e29be6b3268ed44c7d9f7c859b40f0b544b8795e7c25ee5d2e
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmIYA+wW:T6F0eMpAAYEhpnhw
TLSH
T171455C94E783D4F5FD2314F0444BE7FBA5309E2A40318D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{0F2A8454-852F-4501-92B2-2BF5458992B9}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0F2A8454-852F-4501-92B2-2BF5458992B9}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3028-201-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3028-204-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads