ab3f7441f7a934ee88bb0b612f378cbc014c8e334ea5a2e80e8126fdbfb92518

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_410bc976fba4936f21f7905ca72ca55c_elex_glassworm_icedid_njrat_vidar.exe
Size 7.8MB
Sample260718-1pp76agw21
SHA256 ab3f7441f7a934ee88bb0b612f378cbc014c8e334ea5a2e80e8126fdbfb92518
MD5 410bc976fba4936f21f7905ca72ca55c
SHA1 fae19d2f4740d05b4c4737ef0d611ad05395bd9b
SHA512 ca3d5bc76c92bc49cf4ee15bb94884d67d663239e91b49c1886076427278fb581459b8a4411f0074ef14e530e5e5eb6a810232385a997a1a76f2c3a03a7f370a
SSDEEP 98304:u0nAAYEpxhOu1MbQ9yDAD7KjjqkusjmqMhY:jNQu1tIDewjqkjiqMS
TLSH
T1C1867D39EBA4C1E5F9ABD878A97BC672FA717A110833530B89D1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
744	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_410bc976fba4936f21f7905ca72ca55c_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
744	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 744	1212	2026-07-18_410bc976fba4936f21f7905ca72ca55c_elex_glassworm_icedid_njrat_vidar.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-18_410bc976fba4936f21f7905ca72ca55c_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_410bc976fba4936f21f7905ca72ca55c_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXFC03.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFC03.tmp
Size 1.2MB
SHA256 b17c7b784fcee14fed39c21e80dbe87a42b20b2406c088821f964bd4ca07cb0b
MD5 547f71ac0efec2ac2aa7fb4f51418b2b
SHA1 3a2dcbec57b973bdc344789e565da821adfeff05
SHA512 9d018d501f8e15fdd765294bfc490de6206eb00e1849630b599e12d81578b522b269fe8982ad5d1db111bd5e1038e2411b09e1458f5ae160ad46718b8224d745
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOAIYA+wTX:H6F0eMpAAYEhpxhwD
TLSH
T101456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXFE67.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFE67.tmp
Size 1.2MB
SHA256 71859eee4f0e96657e656ddd6abcb0a6c2e90a5323022aa5527c9d0175bbeab4
MD5 ca399ac18ef2ba66293aedfc9fd83829
SHA1 aa938bb0bc08ba3f9ed6fc859dde140041dbd379
SHA512 d81fe0b72464abb03ccc5e32f70bb7fb9edf503791e863e4f2e55d51f1ef05f94106037194e16bbbe7807cdbf75b85ca3650cb6b1b6b7ad73d454bb92d376be0
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOLIYA+wSa:n6F0eMpAAYEhpWhwF
TLSH
T10E456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXFE68.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFE68.tmp
Size 1.2MB
SHA256 03b013d2785de614c49de3bf7ade863e3eb6c8f09fb3197210a4dc886c800e79
MD5 140874ad3a2d1b2d0f886da697ba8e15
SHA1 a52e840e1b1844eabc761b492c4aa07419f7707d
SHA512 9dae027f530780cff04ed85cd6002a1b274f9a2989c367b3d3cff200aa580e9230032270ac898b6c009ed2910fbb96b1ab481a757d0478c2f5fcb781c7b6c9a1
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8IYA+wT/:X6F0eMpAAYEhpdhwL
TLSH
T17D456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-274-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads