ef52d69a4b14f8a0d7938a2a972462fa7db60a4b404abab180a6fdffb5c86f23

General

Target
2026-08-05_33a2dd916a594dd0738093c5123ce44c_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample260806-cs245ack6y
SHA256 ef52d69a4b14f8a0d7938a2a972462fa7db60a4b404abab180a6fdffb5c86f23
MD5 33a2dd916a594dd0738093c5123ce44c
SHA1 88ed37e5ba7233159caeaa02b45dfb9926ddd5e0
SHA512 2d1fca8c1d4057c53e2d5a51b8a4f6bb440895f9d00b0f31e98f2909cd76d37c9d7fce41d894cd120bf4ec4d862564987082d36ce2984dab6735693bb5cf78f1
SSDEEP 98304:50nAAYEpsh2u1MbQ9yDAD7KjjqkusjmqMh5:eNru1tIDewjqkjiqML
TLSH
T104867D39DBA4C1E5F9ABD878A97BC672FA717A110833530B89E1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5164	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_33a2dd916a594dd0738093c5123ce44c_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5164	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 5164	2904	2026-08-05_33a2dd916a594dd0738093c5123ce44c_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-05_33a2dd916a594dd0738093c5123ce44c_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_33a2dd916a594dd0738093c5123ce44c_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.5MB
SHA256 f69c46eda814131ae4853cc809c3b626997178a674bf62d173457887e672a042
MD5 0a0e5893efff9c35c2adf372c1e03d0a
SHA1 085464a1f3e89ece840834cb4bee6968c6ae2022
SHA512 7778573beea714e7ffdb13e104fa5b96dfe2793888ae9448eda979472e6ab4ac57cc5dae6a853a73cfadcf0ff02ca68d062321e3e6634978080fe6aacda80011
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+w9dnMYenGJiKEbXWtE:+6F0eMpAAYEhpihwnMPnRWt4Z
TLSH
T19E759E74E783D4F1E92300F1444BE7BA69349E1944318C7BEBC8EF15BAB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 f01133d63ba53fa691b91be83a3fbad075ea1e76cdee91cd9d005fc0feaa60d4
MD5 a4cdf45d2dd96f434ba41a62cd13a485
SHA1 10be51937665a2dd88e8fce7438cbc104301788a
SHA512 275977e277ee2182c79f04a9f02fe3b0522f7e09a08cc7951b177fe12ed817bbc2287551db4b90c3564b53434c56ced98c8e565a9dd68e0134fd989a79ac5186
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6YA+w91:W6F0eMpAAYEhpshw/
TLSH
T1E4456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 23ac2ad60d555d6cec657e8db6e4bef7612141c4c13a28ce61cd0a68a7749f35
MD5 ed234ed07803b4f897fa14f3ff692955
SHA1 288fb8c0ebde3ff2ae1eaae6efbe5bd0793d2d03
SHA512 ce332d78c925909e991ae7f17a1798c6249bffe9dd269fa83c9bcebaebac30444d017000d3e7ec587a6214b080f6ad4c6c29f683fff5e9a8852816b9915b5b33
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUYA+w8/:W6F0eMpAAYEhpyhwm
TLSH
T1FE456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 94b2fdf43602224de8c84ee732574fb9503339ce47467c44eef8b2041683861e
MD5 5a04ed5aa7451409bfa9e40a58a5f2c2
SHA1 479b99c75d7353b62803d3f5cdc8d6d2e6b31ee0
SHA512 ab60ecb657063f4ac393712c9ef2562b8e36a67e9a20faa20970d3d200851c709068e7e449d4755b29f717eaf9b2b8946cac79ca7a65dacecd662698cb3f8a78
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+w/h:96F0eMpAAYEhpehwJ
TLSH
T157456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-152-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads