b274be8b501b5162db7d48d937b9b505bac63e484fe0b4b1a96c2e52d052cf9f

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_00ea8937be9d03d6d523ead93fb57fe4_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.4MB
Sample260720-d7v5ssd19q
SHA256 b274be8b501b5162db7d48d937b9b505bac63e484fe0b4b1a96c2e52d052cf9f
MD5 00ea8937be9d03d6d523ead93fb57fe4
SHA1 f6dee291080997d10197804ff8eb7028f502dcb8
SHA512 767f624eedc3dea3c6c9e1c03b09e5ff197a795284a58f6240d6dfde7827f077b2f555b94f5906b70547aeaa1a068fee996ed370c2e3adb3f9c2fb7668fbe4a7
SSDEEP 98304:L0nAAYEpmheQA91pH2WpjHrgBFFu416AWvA:YNRQmHpn6F44IAWvA
TLSH
T1BA764AA562A7A0FCE46ED075CB2687B2E6713C274071930B16BCFA563F736142D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5556	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_00ea8937be9d03d6d523ead93fb57fe4_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5556	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 5556	2900	2026-07-20_00ea8937be9d03d6d523ead93fb57fe4_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_00ea8937be9d03d6d523ead93fb57fe4_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_00ea8937be9d03d6d523ead93fb57fe4_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious use of SetWindowsHookEx
  PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXF089.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF089.tmp
Size 1.1MB
SHA256 5592c7494588a5bf19d5a4aef9e78d50fca5d4653203828bbb081b6076e87068
MD5 dbc626eaaf2c41aa29001d77d5f2af71
SHA1 c8ad0c216d8cf4684ba7029ee7ce1ab7e3ada2a1
SHA512 c75a3063e6133a4cd0cd2459d3c9e86194f9a505e45ab27c43217c40db92acbbea1618000ae90820c4393722cc6e760ddab543e12a16e109980e2c29bc5c5073
SSDEEP 24576:a7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOWYA+wSX:J6F0eMpAAYEhpEhwc
TLSH
T1D1455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 ec42baf1240ad9e2db261a674ec0dad18b51e6e9c94b96769847794f1f368f72
MD5 ab2cb63000c7dbfa123c132f70fd6447
SHA1 44e2732a6b4eb3222bf8302c5fc09094df79afe8
SHA512 344357b1f734295c2da95fd390d1821bef61f84218cb69e77ede14b4e8e10ee523ba65fb021e0b0f9227977f8564b3711943abcfaa09b0a2aebc4d5de34a4013
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+wjz:o6F0eMpAAYEhpmhwH
TLSH
T1DF658076B647D4E1D82A14B0CF1BABF652604D7DC0E28B1B96CDFE21FB7195130A620E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 74c823c6f33c9418b2902345b7d7e3d5647be3eb5a4096883e3ee9f4b5fd19d8
MD5 b8aacd4d706a3f678e3822df1caf8336
SHA1 f4f7deea81d0e1f8bab43f893cbb225fcfb917e9
SHA512 0202690641dec6609b145e2158981fc038de05d8d8162a2a9bf75d5133c8d87e1df965034a7b5febf0f9ecd7db2908d54a3e41ca0642ff040f52336366733ede
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+w/q:c6F0eMpAAYEhpshwS
TLSH
T1D0658076B647D4E1D82A14B0CF1BABF652604D7DC0E28B1B96CDFE21FB7195130A620E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-155-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/2900-159-0x0000000000400000-0x0000000000573000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads