c12a87d14937f043a6019329874d5780e9231bb9b637820d12b16e48babd8437

General

Target
2026-10-22_7fe2bdd772bc14eeacede6e70823d550_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 6.0MB
Sample261024-hyvj5aee27
SHA256 c12a87d14937f043a6019329874d5780e9231bb9b637820d12b16e48babd8437
MD5 7fe2bdd772bc14eeacede6e70823d550
SHA1 047c81a2f945f12f9c68562c25b3922ca967d51d
SHA512 f6c5b44de5ea41e0befa34cf404452802bfdfa22f9b9a70fe236df4a9b36604277c28ec541820f70af4b2a872ac4f74c354d6e03e5398025c8f0f09dc970bf6d
SSDEEP 98304:L0nAAYEpihsOo8NN+bClr/fRpm1WqaJnqRIng:YNBOo8NxHro/EqWng
TLSH
T1C8566D52E36250B8E45BC8B0CE1D953296357C4A43F096FF26D4BAE52A72ED43B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4984	original_temp.exe
4364	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chromium_installer.log	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_7fe2bdd772bc14eeacede6e70823d550_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 4984	5400	2026-10-22_7fe2bdd772bc14eeacede6e70823d550_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	90
PID 4984 wrote to memory of 4364	4984	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-22_7fe2bdd772bc14eeacede6e70823d550_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7fe2bdd772bc14eeacede6e70823d550_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    C:\Users\Admin\AppData\Local\Temp\original_temp.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Chromium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=133.0.6928.0 --initial-client-data=0x294,0x298,0x29c,0x274,0x2a0,0x7ff7b8d0fce8,0x7ff7b8d0fcf8,0x7ff7b8d0fd08
    3⤵
    - Executes dropped EXE
    PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXE1C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXE1C1.tmp
Size 1.2MB
SHA256 83780fd8d3387ba75292970eb546207187dddc4a1ab9a4cfb96b6a39b8225546
MD5 ab853c6e0bb62a1b22becab5de85151c
SHA1 b7388a23bffddfca1521c4ffae23680aab751c82
SHA512 e4caedcdbe6d1aa10ab4483361a92a4c358c166edb95ce141dbcb093a79e350186bbd79fa452de0914a8bf34eded9e01a083776a8069d8e9242612285d35615e
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4WYA+wq:U6F0eMpAAYEhpZPhw
TLSH
T1A4456C94E783C4F5FD2314F1444BF7FBA5309E1A40318D2BEBC9EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 4.8MB
SHA256 b8cbbdaab265e6ea58fe0331152797e03bca5c284aa8a11556e6ea68e6340c6d
MD5 b06dc4e909f0dd18ab77dc8b4de38491
SHA1 e848db5948d68384dc4de38fe50e35b34de47f93
SHA512 e753337b902913aa8643c700dd2de3080e1d1e39cd89c43b47074f1408b1ecf75689736f884855f4fc84041c604f5c5abb1796df0cd51ea849486fd77700d37e
SSDEEP 49152:VOmfr/quPy22RBnNOPrF2S5Jz37TulYYM9wfI8padEYWnkXhY2Vsm0C9+qRIpJrL:VOo8NN+bClr/fRpm1WqaJnqRIn
TLSH
T169365B53A36610B8D46FC9B4CF29552296253C8A07F496FF22D47AF51A32ED43B38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 658f1277d467cfb8af1ab719b4f7f8e39519e9a6777a49019247a2272a0e7384
MD5 cc7d88680e0a6713c303a214d993fd91
SHA1 419882c4d1d67749c6187168be9e3f080c3f868b
SHA512 631456241bc8d54d5c9fc525030090cd21fa655fa665a86ed7f841d31f4fd71c9ef418a19b9be0e52998d266d0032eb9dd66c7948d487c101ca7534dbe99dbdc
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpWYA+wn:o6F0eMpAAYEhp4Phw
TLSH
T1EA455C94E783C4F5FD2314F1444BF7FBA5309E1A40318D2BEBC9EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ab32275fd60f2d33a7ccf66e900dfba3f3b75e3d5e161261747b5e3779d41c70
MD5 d4f14999fcd575db600c048b3fc9f16f
SHA1 f874f5903c2366df601114c0ca4e9ce24c23fd47
SHA512 04b156e308413303b862ad81e2ecee0a0fb44626173ad1c555e8338fa38b23031671dc2757f4725ea9eee0ab8fd73a9ebf8dfb1de6eeb3246b48c5cb2c63368e
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOZWYA+wb:c6F0eMpAAYEhp8Phw
TLSH
T167455C94E783C4F5FD2314F1444BF7FBA5309E1A40318D2BEBC9EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 e35a268861d08641464b0e0e47978603e4e3dcdc732e5b45019022fb2d26646a
MD5 c421fddf1ffd0db6435b33e56be45994
SHA1 72d5da37a5ebaa34dd647c876a3e74b361970e88
SHA512 0b1a0e55221ff3de202ddc704ab56b9f98caf08d926f8b13c804dfe9febb7fbc5e0a482ed6ae630df5fc0030db185641043a844435b54db357a32357b4cf29eb
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzWYA+wR:E6F0eMpAAYEhpuPhw
TLSH
T127455C94E783C4F5FD2314F1444BF7FBA5309E1A40318D2BEBC9EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteHide.exe

Path C:\Users\Admin\Downloads\WriteHide.exe
Size 6.2MB
SHA256 fad3e7bd32daa69de3a163c65b3c6f2ed44dec0f5bcd511d8715575a2643fc41
MD5 c413c6049febfb0f3bfa060c6d5df4ef
SHA1 89aace9cef133d4aeb69f588b1035bbf5300f7ef
SHA512 a681528e5c2e4c8ee75bcf60404e8cc78dd47e9c04403557f9d98b349081ac8a75a6f522f338181856e9d7b0c29e5ac6244a999d219f58ae453d0aee2f827a4e
SSDEEP 98304:L0nAAYEpihsOo8NN+bClr/fRpm1WqaJnqRInIweB:YNBOo8NxHro/EqWn/K
TLSH
T14A666D52E36250B8E45BC8B0CE1D953296357C4A43F096FF26D4BAE52A72ED43B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5400-175-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads