1eae419e8d85343d9e5f2110fcaeb010ac1eb40b2e3dfb5e11d25f168145eef2

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_6ab13c7ab0c87249c7603e3452253a1f_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample260714-ebrm6sfz6s
SHA256 1eae419e8d85343d9e5f2110fcaeb010ac1eb40b2e3dfb5e11d25f168145eef2
MD5 6ab13c7ab0c87249c7603e3452253a1f
SHA1 33c3d3765a876a15410f42066a94b86630d322b8
SHA512 4abf66232b61a30737b6307d562f4a0a479f774fb133d772265cde9df78679783e5f846eae5e6ec4cc67134d217dc4473091e5d4f7f6ef9ab6432660c1f7456b
SSDEEP 98304:R0nAAYEpyhKu1MbQ9yDAD7KjjqkusjmqMhX:GNRu1tIDewjqkjiqMt
TLSH
T1B2867D39EBA4C1E5F9ABD878A97BC672FA717A110833530B89D1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
996	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_6ab13c7ab0c87249c7603e3452253a1f_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
996	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 996	3500	2026-07-14_6ab13c7ab0c87249c7603e3452253a1f_elex_glassworm_icedid_njrat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-14_6ab13c7ab0c87249c7603e3452253a1f_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_6ab13c7ab0c87249c7603e3452253a1f_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX147C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX147C.tmp
Size 1.1MB
SHA256 ed5c194e1d8a335a6f0523490fa8663db6230bdd44b379a7f55f306e5e6f9208
MD5 31f7f74eddc14d91b11b9118164b135c
SHA1 35aaed9473015d9830b0fb76c57676fbc413415e
SHA512 0f0e58f1424b749ba0dec967be348974fede8da61ad17ba65e2a3e6cd092dee1303f1cf92cba0c08f1c1e5863b709639934c19b3a886fe28d4e2136b82b413e4
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOFYA+wwS:a6F0eMpAAYEhpRhwr
TLSH
T106456C64E783D4F5ED2314F0444BE7FBA5309E1980318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 0ae49b5073874334cd77e438558b11567d4de2f9784f7bc5e24b7fdc2591fbfe
MD5 9de3f6b4ff279651318c840ef1cdb67b
SHA1 6c56899c0318426ea827a73e83b9befc43521cbd
SHA512 c086066f23cfd4879067400196778a45dd9d198ebca52646d8dc3d9c5be8c2c1c697333e29d2011bf283cb7bc6785beae8d7f8bca552260809658aefa1c92117
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOYYA+wwa:O6F0eMpAAYEhpyhwz
TLSH
T1D4456C64E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 2cb0203d310d98cc9c2e32826db2057a73513e984f49deb875fc262f96c7089a
MD5 5b20f0e0f55908be418d92cb9668dd54
SHA1 a7cfd0184ba1482f755d81ef0fce142075a527e2
SHA512 4b73505212f207c7ce5fc07a7c67bcceadd361f8cf29da87094e3bc7d888de2109a2590c970aad8f06d82ea9ffb7106d28dbe7ed8bd949d50451f54d2463c447
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzYA+w8D:q6F0eMpAAYEhpLhwS
TLSH
T107456C64E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 8103c7968a5ece779833e911f4872174c823f99b2b34817da37fd8aa2455e334
MD5 2563dacf9d5a8cd0b60fc556b9e14cbe
SHA1 92aa6ad6ea2141fa798383b95f1c9791e36da187
SHA512 a2403dd3d9c5e80383ccc34d454b903c584838f99eb95b654095720112f88dd4326e8931f13ecdd44d7a87f29c3f2efdf9de307bd17cf6d19a939c8659e694ff
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORYA+wi+:G6F0eMpAAYEhpJhw9
TLSH
T1B4456C64E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3500-152-0x0000000000400000-0x000000000052B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads