7c91d01a5222e97e8128788049a71a1a0f81937398be3a612b9b8a6c37a09500

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 28.4MB
Sample260723-b9c1wsfa92
SHA256 7c91d01a5222e97e8128788049a71a1a0f81937398be3a612b9b8a6c37a09500
MD5 5ce646f6a844ebb1b792c2323b83510a
SHA1 6be66b3453d5abff7968859d9fe595d30ed014b6
SHA512 15dd4650353d133539134d89d56d4479d23c51ab9155bbf9bf80b9a88047ee16e588bc252103b91f4686d247df3bc3047bba2380e00a8ccf0135765c0f4e109c
SSDEEP 196608:XMPMRB1igDNTanGdTcqIAetaseae7GUgdRUFuQPwf9Y3omTturPMd:XMPMRB8aNTplcqIzwseARU2fAo6Mgd
TLSH
T193674A91B6E843E2E3AA953485B686B6FBB1BC0E1F31533B0575F20E1F376A05D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3376	temp0a1.exe

Executes dropped EXE 3 IoCs

pid	Process
3376	temp0a1.exe
3564	NetNet.exe
2732	temp0a1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\NetNet.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\G:	temp0a1.exe
File opened (read-only)	\??\I:	temp0a1.exe
File opened (read-only)	\??\K:	temp0a1.exe
File opened (read-only)	\??\O:	temp0a1.exe
File opened (read-only)	\??\Q:	temp0a1.exe
File opened (read-only)	\??\R:	temp0a1.exe
File opened (read-only)	\??\J:	temp0a1.exe
File opened (read-only)	\??\M:	temp0a1.exe
File opened (read-only)	\??\T:	temp0a1.exe
File opened (read-only)	\??\U:	temp0a1.exe
File opened (read-only)	\??\V:	temp0a1.exe
File opened (read-only)	\??\W:	temp0a1.exe
File opened (read-only)	\??\Y:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\L:	temp0a1.exe
File opened (read-only)	\??\P:	temp0a1.exe
File opened (read-only)	\??\S:	temp0a1.exe
File opened (read-only)	\??\Z:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\D:	temp0a1.exe
File opened (read-only)	\??\H:	temp0a1.exe
File opened (read-only)	\??\N:	temp0a1.exe
File opened (read-only)	\??\X:	temp0a1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bb.ico	temp0a1.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	temp0a1.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\temp0a1.exe	NetNet.exe
File opened for modification	C:\Windows\file0a0.dat	NetNet.exe
File created	C:\Windows\NetNet.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\file0a0.dat	2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\NetNet.exe	temp0a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetNet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1140	2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1140	2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3564	NetNet.exe
3564	NetNet.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3376	1140	2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	89
PID 3564 wrote to memory of 2732	3564	NetNet.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_5ce646f6a844ebb1b792c2323b83510a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3376

C:\Windows\NetNet.exe
C:\Windows\NetNet.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetNet.exe

Path C:\Windows\NetNet.exe
Size 55KB
SHA256 e362f4d68a5689e5263db01871c5692048ed556481546d3f3a42f3f8e10c07f9
MD5 11537c2001d856141b2b93f3c97eeb88
SHA1 d06262f1984b30df2ebc3d27a471b74ba7cf54e7
SHA512 b0857dd70e340cf6147c3e3d1eb7b1a1328bf205b5671f201b5d5f38404cbefc7e650b74694217f712d39df2a0c8d4668974dc5bf7aa2944d2e3e9578fda87b2
SSDEEP 768:OkJvvqaxRyEtyZmC9Lm09Pv2pMJ0+s4t9cpO5vAjXFBS3Q70PcLHQitRr1DJSBOx:z3qaxRyEk9LmQuyPt9cgY4PcLH7nk76
TLSH
T19D435933F6808576E055DABC5C19D144AE3C7A20AD3BCCA6B7982FCCBF291D0541DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb.ico

Path C:\Windows\SysWOW64\bb.ico
Size 4KB
SHA256 823cbf89390733bd09d5541839786670d748064e50ff235928abd9e2433192b7
MD5 84a8ab049bb249ce1b1e25d5648571a9
SHA1 66b48c0e63f542b74a5b003af9660222c1d0f324
SHA512 8ce3b7fa9917ee0164b3a09920aaa1ec6806159aab184e3fbb15fc58134c64957811eded9ad3d459c0c1a257aee3129473136d1800f5d89bc9adc5a43a4b6c64
SSDEEP 48:z2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:z6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T19C91553EA718B8B0F98E6DB1236FC064505E7504151BCDA6B1A9FCB07F92CEA40143CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 21B
SHA256 3e62755a4e5d33652422db078a1f609944ec2d4f7000d8d736e9f655b94cf3f3
MD5 433aefdace81b018f47fdefeef71354b
SHA1 ac9383c21edf3dfc2e142fb9b947a58cd89dfa16
SHA512 7500bfd750c46675adf3bfb670a8b5d3de5099a0064afe1bb132ceb67631940446199a311ba4244d1ba37693b733fca6be57db3cd8487289dd1db5ee9f5f9a9d
MD5 SHA1 SHA512

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 129B
SHA256 ff5078cf88ca8324082e8c36dd450f1c4f532c2d131e23eb244e3d3e86fa8448
MD5 0cbbcc77ccd873e599d7d1bb09a5562c
SHA1 8a88f8a30c8b6344dba2e71d6cb40931dec7dc33
SHA512 2b4cd9e6af6fe559db14f4a787a00c005f70e0d86b58e8c58a5e4ffef8ac6741935bc2f12559096c35bc78a32bbb58525c681f5ac618b97bcebabc30fba0c5d8
TLSH
T162B02B04C5EFCF80002930C200110C84C063240DAB1433008B30C41D31E640B25A0741
MD5 SHA1 SHA512 TLSH

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 28.4MB
SHA256 7c91d01a5222e97e8128788049a71a1a0f81937398be3a612b9b8a6c37a09500
MD5 5ce646f6a844ebb1b792c2323b83510a
SHA1 6be66b3453d5abff7968859d9fe595d30ed014b6
SHA512 15dd4650353d133539134d89d56d4479d23c51ab9155bbf9bf80b9a88047ee16e588bc252103b91f4686d247df3bc3047bba2380e00a8ccf0135765c0f4e109c
SSDEEP 196608:XMPMRB1igDNTanGdTcqIAetaseae7GUgdRUFuQPwf9Y3omTturPMd:XMPMRB8aNTplcqIzwseARU2fAo6Mgd
TLSH
T193674A91B6E843E2E3AA953485B686B6FBB1BC0E1F31533B0575F20E1F376A05D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2732-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2732-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2732-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2732-47-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3376-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3564-13-0x0000000000400000-0x0000000000414000-memory.dmp

Download