21e1f41fef75f3943c48b03fcd8ec7630b4477876684023892d54733302b496a

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_518268061e250a9549e36102f460df4f_elex_glassworm_icedid_njrat_vidar.exe
Size 8.5MB
Sample260804-n58cfsv1at
SHA256 21e1f41fef75f3943c48b03fcd8ec7630b4477876684023892d54733302b496a
MD5 518268061e250a9549e36102f460df4f
SHA1 eba7f080376f947f547a612ec4bb7dffdfbd8043
SHA512 84d4bd395e0fb459f8b2309aad61ffcc64e28ef5441e3c53a82d79b5e5821a6f394f71ead189cf4ff3fa2b1c14efc9fb8639e4f59bf0adb6db437bbfc1774308
SSDEEP 98304:F0nAAYEpVqAu1MbQ9yDAD7KjjqkusjmqMhI:6NLqAu1tIDewjqkjiqM6
TLSH
T119965BE9AFA4A1E5F9AB9838B827867DE9737D100833530B8993F61E6F335514D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1588	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_518268061e250a9549e36102f460df4f_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1588	3720	2026-08-03_518268061e250a9549e36102f460df4f_elex_glassworm_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_518268061e250a9549e36102f460df4f_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_518268061e250a9549e36102f460df4f_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX9D91.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9D91.tmp
Size 1.9MB
SHA256 c1664f00301d7c98caf0bdf9d5384a6fbd2765841a8174ef813b8b1fc29cd448
MD5 865244132fc337d659213597a70e77dc
SHA1 3758cd590314b6ef46e34ea9e272cb252328d524
SHA512 d8745e1172f8f7ec2e412d36de5a34a73431d0544f9ca5a9d1ef72c43cc3a74e45ba007cfcd76fc659b267a6966225ab139b3684f6c3b882adf87db0f2fc75f6
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtqfC:i6F0eMpAAYEhp8q6
TLSH
T1C9953AE5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 07c0c566afc8c26b6dd4a4a077178936b97927f7ac7ef1a369db222ee5aaafd6
MD5 3db4bc1755670e7251d11575f2106f19
SHA1 7cdefdf44e255c50372170df7ddf3ca19e8d936e
SHA512 1686eaa492a7814230a1254df7e495eb1e079a2e7d7aec03db36e1e77bae60049b9ead280061a74cfd2915613d795fee6d7a187b502f4e30b40816cda8c65ac8
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUqi3:K6F0eMpAAYEhpVqA
TLSH
T17E953AE5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 4e434a77a62236a5dab821d08161f5432d7b6d54d4692a6c22549714f2fece67
MD5 8e6f4c4c445a4a4fc04a9264bc79f7c9
SHA1 9d944a5040535ceaee4bdca5b999611355db908a
SHA512 92b9151bdfcb8e751a392f4a87ff31efd945bfb66a60239803f72aee767286c056bae4c3e48052503668dd6648b81c317a960c63f9ea477d96f5210ab7b58624
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9qf6:26F0eMpAAYEhpwqy
TLSH
T10D953AD5FE42F2F2E8920CF1350BF6FED5236D25C8228963B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 4cbe2191371df54ee987a2015b13eda7c2e3521214ad7a6046254ae15a4d9c5a
MD5 4df8e33c0429152781a4ded391816902
SHA1 c081dd1937725b27a6e59776430f70f59249d984
SHA512 07c1b2e1168e18492d2c6c8a31f54c2fbf92ffbd4830c28c04fa9f41d8965c8e7c29659fd058d876d85cce949a2f6d03252b5ccb5c2b5a2a7ce95303f7b5674b
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/q+V:q6F0eMpAAYEhpqqq
TLSH
T196953AD5FE42F2F2E8920CF1350BF6FED5236D25C8228963B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3720-154-0x0000000000400000-0x00000000005F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads