0ed93c03b7b5c7628432175821424bbb9a70fdb9bcad4f14a242e18333420e22

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6b63f798bed3aedd1db5d957c9165097_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.1MB
Sample260804-nmangavvd1
SHA256 0ed93c03b7b5c7628432175821424bbb9a70fdb9bcad4f14a242e18333420e22
MD5 6b63f798bed3aedd1db5d957c9165097
SHA1 e152bc88c9f4b8a382e76a37ef1fa557d6cb3c50
SHA512 7d98530a794bbfcf92e4b006e4425866c29afde92452dd6c090617d61c5aa1eab66a1c12c080d5a554edeb06a0a51b0c1d3317d7d448d4b53fd708f52ee183ec
SSDEEP 98304:C0nAAYEpxh+QA91pH2WpjHrgBFFu416AWvg:nN8QmHpn6F44IAWvg
TLSH
T1A3766CA5A2A760FDE4AFD075892AC732E6717C130031970F16BCDA563F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6040	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_6b63f798bed3aedd1db5d957c9165097_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6040	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 6040	1152	2026-08-03_6b63f798bed3aedd1db5d957c9165097_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6b63f798bed3aedd1db5d957c9165097_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6b63f798bed3aedd1db5d957c9165097_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX9890.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9890.tmp
Size 1.2MB
SHA256 be3f4d836410b2eb10e0bf9145913c6a0b0fa0c1adb990e4e74d8c6b49aaa187
MD5 13570a59b3f856f24f2d1867af8c1cf4
SHA1 5b2edae701899bdd11407d2f4a5dcc6a902b253f
SHA512 a329ce07ee20a07d525424b7672c81d1f23707242a90c28e63d25574500ce8b80d62ece763836fdf72195687235244a8cc132c16b9fd1a0d12e64cdafa43b1a0
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4h1YA+wxS:T6F0eMpAAYEhpDQhwo
TLSH
T1F6455C54E783D4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ffcf581b5da4b1d2a5903de3a29e0263e1c8d1a8e403d9c5e322fa72299a5ce8
MD5 852222ec5bcab5ea099d024adab8ea30
SHA1 35cd94560b71c44a4c12ecf64267d53b176c88a2
SHA512 b3da51e459fde6223b1ef5ff11ccea0759710ad8e94bb5ef4f40c5ee4f99ed391b6394b9bbb5528923c34ac22bde902297dd70d5c490605a192e3e1a684d5d6e
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlh1YA+wUq:T6F0eMpAAYEhpmQhw/
TLSH
T134455C54E783D4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 049c032e74f5fe4d1158c863218cdbad64f417495b1e3de69557f7ba18daea7d
MD5 3a14c6fe109a0493e71eb44bff85caa4
SHA1 5cd91b5cc9ed6828d03aa65539dab8ba340137ce
SHA512 4dc71af1e2ad8cb7715da957539194c25906c740f3a81d3b0a7f14e2966297d7bffd54ed53669f931575907b0c7fc79b80baf7943ae000a1ccd7a5a45677dac9
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOSh1YA+wcz:b6F0eMpAAYEhpFQhwC
TLSH
T16D455C54E783D4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 4df1cfc6946a45f8ff2ec2ecd2a3c52677a20854f900eb74396af9d3589e6e4c
MD5 17457841f5339fc9c3ba517df0edfee8
SHA1 d41dac75a8aa0c187bc6ff5bfaf2d09342974602
SHA512 bd938827cb94225f9470053017708abfa6840413022ecae02a5a3ca854d0787b169892d94860a133020da7f4dbea03e5c692debfc06762450634663d9746ed45
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVh1YA+wZ5:T6F0eMpAAYEhpmQhwP
TLSH
T172455C54E783D4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-153-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads