5e634e8ded2122a1963f51fd888241f4d8f20db9d97c9dc1e5c5a195d891e746

Analysis

max time kernel
150s
max time network
109s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_4469cd16228bdf080a69e98de593ba13_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample260714-enakesgs2w
SHA256 5e634e8ded2122a1963f51fd888241f4d8f20db9d97c9dc1e5c5a195d891e746
MD5 4469cd16228bdf080a69e98de593ba13
SHA1 b91cd8c5af542a8c5000c47f6008902018a11d8d
SHA512 6e9d283a0773a1348ea555b811ca49244377b0f000fef6110b64a1124ff1adc57624ec6ca130beb361c8479e38d83b425a61654357b364985b8a4d0f594b4a2d
SSDEEP 98304:10nAAYEpAhVu1MbQ9yDAD7KjjqkusjmqMhN:KNsu1tIDewjqkjiqM3
TLSH
T130867D39EBA4C1E5F9ABD878A97BC672FA717A110833530B89D1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3460	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_4469cd16228bdf080a69e98de593ba13_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 3460	832	2026-07-14_4469cd16228bdf080a69e98de593ba13_elex_glassworm_icedid_njrat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-14_4469cd16228bdf080a69e98de593ba13_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4469cd16228bdf080a69e98de593ba13_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXF933.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF933.tmp
Size 1.1MB
SHA256 ea70356a6b9e90b7263e8d23137ef88eb70590fcbff577a6b27540d117671559
MD5 149210708166e4eeb03b654df623e7ae
SHA1 0a3ea597b417b77ee22f952f81e121de8fc89400
SHA512 411d60c721566946f2494bcc8c3ed2ce84fb30ddd81e4a0292a2877fc7ffeee1baba5478e0f92dd2ed587daad58105883141957d4e6874ea956fc9903ec91ee4
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOCYA+wao:e6F0eMpAAYEhpIhwb
TLSH
T110456C64E783D4F5ED2314F0444BE7FBA5309E1980318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a34e3f0856e453b022da09dccab765211d751a25f274e60b703aaa14af8c4cdb
MD5 ff35a71ac07b051e6a556e4f4998592a
SHA1 b72f3fdf2f3d2e4b31a5c5834b69e64dd2c5399a
SHA512 e3a5b7208bd33de955fe22b2c9738610032effc47c612100f71056b2872cd803998e71cab1f47f4d04d74fc38c573000c36ce76644f3de4eed615d48b0fa2396
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+YA+wXQ:66F0eMpAAYEhpAhwA
TLSH
T15A456C64E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 414db647d0348bc4151fafd19c7b3ce2400e20abf06ae9344e9c85d72a931d02
MD5 afe08c504ff4cd5f69f297984ad1a864
SHA1 b4ac20a963fdd6219d1e3ddd1f2aeb16dfcfe74b
SHA512 b9c9721cbcbbe0a03076b524ee71b7dbd5008ac047584435adfacb1d9cb83ee840a431aa971500c8c54629059292db310763eda20695f13188cecea415057ada
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+YA+wzB:a6F0eMpAAYEhpAhwd
TLSH
T1F6456C64E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 c52ec5508bcc586aa901823f664652f1e8d8d17a8816a4fd70bfc7e1df97e703
MD5 fec58c280af2b459ed2704f1a254c0c3
SHA1 34ed567204ed6ebedb58fbf43f43f413db360bb2
SHA512 6d248d56e6eb593f96b93a3def87cd67a9e6e7de8984634e0d8edf83627b03dd6b99374f7d85c76251d0048cb7ee201c90e4c50240782d6ee728176a82024fe0
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORYA+wb+:G6F0eMpAAYEhpJhw6
TLSH
T1AA456C64E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-153-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/3460-152-0x0000026D313F0000-0x0000026D31408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads