aa1adec3c3466b42f6505d47f14ed8853f98cb7a15a0edba86ce5c1b403c83b1

General

Target
2026-07-18_0b40cde16f2819b05f5493ce9a6d685e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.1MB
Sample260718-kvmq8aew4n
SHA256 aa1adec3c3466b42f6505d47f14ed8853f98cb7a15a0edba86ce5c1b403c83b1
MD5 0b40cde16f2819b05f5493ce9a6d685e
SHA1 e51a2d23568d4c4add30785a6ab55ce947615657
SHA512 3f3ea0fdb279df0357f6c671bcef4492d0cc6851da4a3b63b65b33bdcaac3978bdbaecd5f159debd82428f4c59d498d97492b088e69a219525e12b7b83b051b1
SSDEEP 98304:y0nAAYEpqhgQA91pH2WpjHrgBFFu416AWvM:3NTQmHpn6F44IAWvM
TLSH
T1F2766CA5A2A760FDE4AFD075892AC732E6717C130031970F16BCDA563F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_0b40cde16f2819b05f5493ce9a6d685e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 3444	2792	2026-07-18_0b40cde16f2819b05f5493ce9a6d685e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-18_0b40cde16f2819b05f5493ce9a6d685e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_0b40cde16f2819b05f5493ce9a6d685e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXB263.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB263.tmp
Size 1.2MB
SHA256 f95cc28eb442d63025e7392ae0638a4c5eaeb8a51e8628d26daca01fcecd83ee
MD5 1f05fe289b70dc8ade02452223fe91be
SHA1 f890c2ca795153d19c2b34172427767a32007276
SHA512 860efa62f8aa27dec36e9a4ccaebaef025335b783697199d40dad434a7d42fb805a63ad885e29785b4987798acb9e723ec3bc7b80bdd7261c8a07903c2f705c2
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO7IYA+wnJ:D6F0eMpAAYEhpqhwJ
TLSH
T128456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB524.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB524.tmp
Size 1.2MB
SHA256 4d5499221d3282339a1ad30b7105a7fe3fee75669f77f4307dd10ec21e3e099c
MD5 a7d18f50635d07104fd045cdd754e479
SHA1 4dcae67d6ee81a7efa167b2d62b56f7ab28fb2c4
SHA512 4bb5814f8d23fb24edba85055400bc697e16fb3b30a3503d9caa7e5975e06f57ccd050b8ac0595d97759707e1222bdefed50d1bd9a7ff0eb5f74d20742ad00b2
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3IYA+we9:X6F0eMpAAYEhpqhwO
TLSH
T1B6456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 22f3fd93aaea148edef57aa8888ed6b1da67322a97917f3b17f9c8152d07404f
MD5 f428ee87621104e364409faaf5fe35f9
SHA1 9261a4cc33121a750e2a2683a42f5ac9714fa21b
SHA512 de6b41a95afd2d015f1b30fa2a8b968ec0ff59b2a489fa042cfc69135e2dd9c8a2bbb340dbf8385fe97b81451da772c88895adab054d68bbe772493e420f9ba8
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMIYA+wnx:v6F0eMpAAYEhp9hwx
TLSH
T13C456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7e3db334b234e19bdf2036824c550f3bdbd3a5dd78530bb492f0ef0660d3f684
MD5 cfa3e8641648286b55df5344904e382f
SHA1 33e13c42b0d5b2987f5cfae501d63f12e7443bf8
SHA512 fee9f4899de584b75a60e0284f93a1b932e84be32e6f65e6907e6fe59af3678a956e8eb7c477f842a105807b4eed48cfda1f879b9f01fef3307f9a6efdc7159c
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVIYA+wel:/6F0eMpAAYEhp8hwW
TLSH
T1F6456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2792-267-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads