f4d3247e4573bade06d30935ea3a94726c3233b71447b34dd0070f88eabf7b51

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_e73e096833657f7ae4fa4e9abc9c45d6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.4MB
Sample260806-bfpgtsbk3w
SHA256 f4d3247e4573bade06d30935ea3a94726c3233b71447b34dd0070f88eabf7b51
MD5 e73e096833657f7ae4fa4e9abc9c45d6
SHA1 49ba9313ef652c698e0f2d00ace8c865c3bd4e32
SHA512 20e984511a35e724f9ec85e27187c2af990b1320e95bf6515c712b85ddf93a221cade1c2d613235e0bd219b6b6ca46b1e726683942fb28da6cf2f77a61789d2d
SSDEEP 98304:D0nAAYEpK+hHQA91pH2WpjHrgBFFu416AWvW:ANEaQmHpn6F44IAWvW
TLSH
T107765AA5A6A770FCE0AFD075992AC736E6727C130031930B16BDF6562F736242D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
272	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_e73e096833657f7ae4fa4e9abc9c45d6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
272	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 272	724	2026-08-06_e73e096833657f7ae4fa4e9abc9c45d6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_e73e096833657f7ae4fa4e9abc9c45d6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_e73e096833657f7ae4fa4e9abc9c45d6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXEA7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXEA7E.tmp
Size 1.4MB
SHA256 ad87962ff782d738ad129962c0f61d95d0f1f923ef60643e6f95383a48d37831
MD5 4fad027466a816dfa207993ae61b884f
SHA1 4e3ade9c01b875dd14359b59308dd0dd5db83cd0
SHA512 9409dab573f662f6b9d3e6d0e61f66418f8ad738511a8410b6c7c39df3a1dd67164d3e2dc24fb863abbb77e5e6ac0597596dc53df70d34946d8e19f59b3361f0
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOI1YA+wwU:l6F0eMpAAYEhpx+hwh
TLSH
T13A654BD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 6fc7402d53552cb4f575fcb28acc17ad73bc157384b60f9e8a01a352ba279f07
MD5 50aa5112a89acf6a2f5eb90a13030375
SHA1 20b7fd071a36ba73a11a79dfc1102aec2f90d567
SHA512 78dfff95d72e0f1c44782cf59d285f0b4d107272698526264f6baf8fc964a47223d6d3155b4296558f74f4f1edcc415e294c71fddbfda9ff6603cf5a19470fab
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOr1YA+wp8:g6F0eMpAAYEhpK+hwS
TLSH
T1C6654CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 ab0029f4433b84581e53640149bda66b35833454784b9c4f1b8102f477092e4f
MD5 7f67810b75ad3437199aaf9b1491f3df
SHA1 1d4e396be8660673952a67973fd0cc2d48a67308
SHA512 67590186a2c19dc6c6352e74c84d23cc5f2e45ba27400a92d4f42a6eda890721c906a200688135f982008198a091279901700bc17ac44ce9e08b54379d281efe
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOy1YA+wNS:E6F0eMpAAYEhpf+hwM
TLSH
T1F0654CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 516a57e37b372e8adf73f79f43397dbd17435ade21e1aed8dbce4abcc4381575
MD5 75c4efc4363dc4e7669a93241c47fda5
SHA1 78548886eb8a1cbd7ed112eb58c178d9d56af8f4
SHA512 6cbffac9827a228580272d9a56a4bd2c9bcc250298939c7d6398e36408c61b91c43c9e407a259750f7090e16934fd82d94b0aca867216c33c011b18139ca22e8
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOm1YA+w7A:I6F0eMpAAYEhp3+hw8
TLSH
T168654CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-152-0x0000000000400000-0x0000000000571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads