b9f988901222dc767da5157ca379a78f3a6f5cff4dcebeaf201a27853a8f64bc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_e642ddec479294aff849b149d926a9a8_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260708-enqlmsav2v
SHA256 b9f988901222dc767da5157ca379a78f3a6f5cff4dcebeaf201a27853a8f64bc
MD5 e642ddec479294aff849b149d926a9a8
SHA1 55a2fe1429a57246b01bf17de2cb88e2598f2066
SHA512 6d2531a6b145581128377c049882a179619ed12e371bfc60ce30772ecf54884514097d396f94f27c56bad466feb184c57b32b382b8e913cfc56e654f693b69e3
SSDEEP 98304:i0nAAYEp/qtQA91pH2WpjHrgBFFu416AWv0:HN5qtQmHpn6F44IAWv0
TLSH
T1FD8617E16EA770F9E0AAD075B92A873EE6733C130031530B267FF6562E736146D19722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
3944	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_e642ddec479294aff849b149d926a9a8_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3944	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3944	2900	2026-07-08_e642ddec479294aff849b149d926a9a8_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-08_e642ddec479294aff849b149d926a9a8_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_e642ddec479294aff849b149d926a9a8_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX64EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX64EF.tmp
Size 1.9MB
SHA256 ce7b9fec6d878a3c5b718af0685862e1792ce5e4485e85a13cba213f9078622a
MD5 e5b957c0618b01aff2330d6b5f25f056
SHA1 6c45f8ea20ba3affcc27ca1f8c2296f71786c5f0
SHA512 f36e5d219412534828cab3e5102f8b11beeb200f16a801f5686b474c61b4702259025103795b73f87186a484c9a30f54472b40b2cce58b1142f3d419ba8d5902
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuqlb:z6F0eMpAAYEhp/qt
TLSH
T176954AD5FE42F2F2E8920CF1350BE6FED5236D25C8228963B687FF28B573A116519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6753.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6753.tmp
Size 1.9MB
SHA256 253e82d57e8313ef62d03ce6af73b65ef1401f92243aa0fa606645b2be4d6a03
MD5 20bd461c153104ff88369c5e57bf548e
SHA1 7fac7ff95de835e55b75a2c6cb1e266c0b359a69
SHA512 b00a4ee2d5d954e8d4bcd2b956b286dc557123675de9337b5f0f14dfc899d09911a53b679bcd94139afae7bbc3c0d7369d59c38cb2250a031c2bd1633b3f9841
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOKqQX:n6F0eMpAAYEhpXqC
TLSH
T12A954AD5FE42F2F2E8920CF1350BE6FED5236D25C8228963B687FF28B573A116519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6754.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6754.tmp
Size 1.9MB
SHA256 180821326304b75331c38f45e645638bd2988fcfc0f3600226c75f91c0498f97
MD5 31de7ac8fb7b2ce43f90fb50eaf43500
SHA1 63ff7c0a192dc8e9ff3b3f5f36599b5bd4d0d6f5
SHA512 6ce8633ca45eee7c2c7bc6d08d6b3f2e2760c5badada8bae3c7e8e682a75dab1bbcc6de2d1d1a157c64792935901a0a3c42cca2c5bda283883d5f9d651eb44a4
SSDEEP 24576:W7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOqlc:t6F0eMpAAYEhp3qm
TLSH
T1659539D5FE42F2F2E8920CF1350BE6FED5236D25C8228963B687FF28B573A116519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-253-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads