aa78a1fe7a42ee66d4a06888092aaedbce3aa96717054d7adaacd0c8c592f06a

General

Target
2026-07-08_75b3c25da293074e8d0a31fc551d830b_elex_glassworm_icedid_njrat_vidar.exe
Size 8.5MB
Sample260708-e5b5ksay8x
SHA256 aa78a1fe7a42ee66d4a06888092aaedbce3aa96717054d7adaacd0c8c592f06a
MD5 75b3c25da293074e8d0a31fc551d830b
SHA1 4e71151bfe80451d230386c6a3f7b11175fb694b
SHA512 07c9a0e39c9b221d5613f59bb54c62055750830ac12bec13880235a08040a7a645e34d290977169c6a999320f1c5d75a92646f81936fd8c7ce88ae7c14d8ee38
SSDEEP 98304:l0nAAYEpnqvu1MbQ9yDAD7KjjqkusjmqMhg:aN5qvu1tIDewjqkjiqMi
TLSH
T193965AE9AFA4A1E5F9AB9838B827867DE9737D100833530B8993F61E6F335514D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
3388	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_75b3c25da293074e8d0a31fc551d830b_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3388	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 3388	1136	2026-07-08_75b3c25da293074e8d0a31fc551d830b_elex_glassworm_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-08_75b3c25da293074e8d0a31fc551d830b_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_75b3c25da293074e8d0a31fc551d830b_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.3MB
SHA256 d91af1a4fd736d19a60f89195437c9090f8f7158705cb6c970f67f7ad9fd7980
MD5 cada17ec2a190877116dc15e1dbb5360
SHA1 9951208ff8e13ea25867a9bae9910d64c681bd89
SHA512 0c1dd205dbf9dddf3eacaf56cdeac4cad23598016bcfe6eb73d6a9e79033d599d6a895aa5044616507aceba6ebfd7e4c78c2d81141ec135a0a38989ad5d80d11
SSDEEP 24576:H7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO0q5783npi63iO:M6F0eMpAAYEhp1qZ8XpiMH
TLSH
T173B54AD1BF82F1B2F4A309B0791BE6FED5237C218C32895BB783FB1865726119569312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 2.3MB
SHA256 2e461e9d9f56eeb38188c575a9f1908b1abf6864f8b6af7164b1311efdd96695
MD5 1b8f9d3c38eff2144ef6761ccce52f8e
SHA1 d30f8f56c769331040b823a98605002a85e9429c
SHA512 b3ee03a4768577b848aaa7778dd390c49ca8761923ac2474b7ca3f530822811e0ed7869ccecaeb9060353418c60172c3a755ec3d1b8076bd4c4ee2b80dd844b3
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOkqte8MYenGJiKEbXWtfOkx:g6F0eMpAAYEhpFqILPnRWtGkx
TLSH
T15CB56DE1FE42F1B2E49308F1750BE6FEE9336D2988228867F783FF2875725116569106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX453.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX453.tmp
Size 1.9MB
SHA256 af2a03bdc34bdfa5568b19bcfe5e3dfda70a771fd31526475196029dd8ee3862
MD5 c0105508e6f706534d0abbb7ad668e1d
SHA1 3457b71b468ce9976d42793dd407b1ee8c4ebc2a
SHA512 5f492d326abcdb251d68eec42426ef3515a1c5c9b83e142dac25dd6c7fc49541c0dacd88824d996ff11da42a42c792d510615196540da98bae9ca5086d41a213
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlqtW:O6F0eMpAAYEhp4qg
TLSH
T1B29539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX463.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX463.tmp
Size 1.9MB
SHA256 79dcf6e06bb1d519be3070fc99396d79304fa6a1c7e1e686ef8d806870de1142
MD5 13a16f7641e1c093acd654541cebedc2
SHA1 7a1c641f52ab067dfb40a8716d7788a6f3fee06e
SHA512 404fa4073ceef0dd19cea22dc3b7a166761629223907993ee6ec4d7b3a2d9800ed38ad6ba4ec0436c4fae4dd4b23d95f6dad1d9340e0ea1ec2fbcde87063834a
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOGq4i:w6F0eMpAAYEhpPqH
TLSH
T1179539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX88.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX88.tmp
Size 1.9MB
SHA256 bb178f7a578fc346d6493d5a4f9c0b012fad60fdf27acfc7e2d91c91556602ce
MD5 adab016e9e3a26e1ee2ce6a184e81834
SHA1 42bbc4617954db04767a8d081e847f06e6f0f462
SHA512 624c8a6e10b048fabfe63289926e30b9d52244dab03f442fae23885132d44b2c75d125faf7e570c9fd6cd6af682d03bff54f143e2d21f85752020c7c38764d33
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOqq4q:q6F0eMpAAYEhpnqv
TLSH
T1DC9539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 e433cc7fd1242e07b788f3f736e4590d19eed245e02d5555b00fd3ac6c88ed5b
MD5 9c00858e903245aecebe798f5dffbcd3
SHA1 b2799d8f71e5ed26abf9eaf70df2dd92e3b4d581
SHA512 448a60f701c0f5e7ff66eff95d4f9f5346fe8a3aee97fbfe8df63b0d0f40d3a652d1db37ab046d82b1bb636f6f2e456b2aa48f442e7364a49f5c551ad08a3ded
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONq4h:Q6F0eMpAAYEhpQqE
TLSH
T1A29519E5FE82B0F4E8930CF1350BF6FED5236D2588228967F687FB28B573A116519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-260-0x0000000000400000-0x00000000005F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads