2223710bc58a1f2016ae35d93687227a1a9a8a1d2a8fcefc758bf5857d416c32

General

Target
2026-08-08_2a51218d0d676e4a2e876a5641573485_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample260808-egdnhahl2x
SHA256 2223710bc58a1f2016ae35d93687227a1a9a8a1d2a8fcefc758bf5857d416c32
MD5 2a51218d0d676e4a2e876a5641573485
SHA1 0ff7a8ffd177159cf0d2fd2341eaabc8677a6981
SHA512 609a7ca10291c748f490558a8a4b3eee872135f593331d6f68cf04d22d6c9f03b19165767ffce02d7c2dcd6f73a8256121aebdfdf2fd7627269274f30d044c6a
SSDEEP 98304:C0nAAYEpghru1MbQ9yDAD7KjjqkusjmqMhp:nNmu1tIDewjqkjiqM7
TLSH
T112867C399BB4C1E5F9ABD878A97BC672FA717A110833530B89E1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1628	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_2a51218d0d676e4a2e876a5641573485_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1628	2580	2026-08-08_2a51218d0d676e4a2e876a5641573485_elex_glassworm_icedid_njrat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_2a51218d0d676e4a2e876a5641573485_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2a51218d0d676e4a2e876a5641573485_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 25b694171b98716df3a977efeb92ef5ad22c4a64bbaf60c8f2ac3b3e98529900
MD5 7dd1a0d5a8a465ae8c3814c74f8eb229
SHA1 fd22f6ea579055b82f1073b16d00df15e938c93f
SHA512 a0d46f10eda0a338b610d342fb32750ff7f484cdf3cffa87b313984cdac9cb29e30551cd04579fde4e09f27b0a9fdf3c6460da544a342b9ca2edcf7b045b2fc8
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOYqDERs47WXnueVulvspdbl:A6F0eMpAAYEhpFqo37WXnu6ulvKdfLMq
TLSH
T168F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX54B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX54B1.tmp
Size 1.1MB
SHA256 52d6d24ee55349dc6f275fff92814805deeb916d96f205da70ad327623ec1456
MD5 a83330a2317be44a67b08701964194e8
SHA1 0c57954379f9980b821065aa2cb33ebb09cb4a4f
SHA512 f8f504f5c8ed46a4c6caa4d53459621a294b3f2ff30af4312a1c2e28413f91837cd8fb7808bebae298673d36d3acc3c9778a23af1d6c1d4549d3bf0e7d4a3d8f
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHwA+w7t:W6F0eMpAAYEhpqwhwR
TLSH
T1CC456C94E78394F5ED2315F1044BEBFBA5309E1A4032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5fe4e577af7b8a06036f794b5c359570b5eae5a7847ec3a7daba0c612fc63a74
MD5 0ce8100bb464c2952d9e02aea7a59fb8
SHA1 ac206119dadd9517ec489eaeab446544cf7cac16
SHA512 fd7f234331e4afbe7b2d292d0ec58253b6afea188eaa7f23832b11e58eb80fb7b3a3bec96d5c9d395151274a21988c6ce1d3c5801d9911c340a8afefa3e04b91
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuwA+wWB:T6F0eMpAAYEhpXwhwW
TLSH
T1CD456C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 476d8e2612d0706d49824430508acd7f9f363999f83e4e450cf0f6596926793f
MD5 21a546c6a55b845ee9eadbcf260509b1
SHA1 a61ae3f9d2044695cf3e326fca1410f176f0baba
SHA512 f0f8a6f3d9dd9f077fd298f8b8acfa3835c28f34e8c6dcf26cef90f01f3894a0d83c4e8ee2831618cd16f558af2cd284a6c473de77e1e4cd35e4ef01f44d7d9d
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrwA+w71:L6F0eMpAAYEhpGwhwZ
TLSH
T11C456C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 d2c94848e37b94b6e836cbcad7a100fd72414a9d4277fb5e85bd83083108711b
MD5 1361c95613051224497f899c26e8d18f
SHA1 d20860444644a9fb0f3fbfcf985033230092c40b
SHA512 12552566c7987967acabd2a33420cd5dd9802385f7536de389e4f7eecb29b7364456509f63bda42b5deda1dfb4dee32d02688cec0fa69ba0e05d99700a7133fd
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+wA+wOC:b6F0eMpAAYEhpbwhwR
TLSH
T1C7456C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 57df82e379a07ef328d1d035a9d51007fa142378573106b305aae25cdbafd702
MD5 2568765305748f4d2b2ecec4bde668db
SHA1 2af9a93babb7a9e618e282137f51b6614f2905e6
SHA512 644cee18c8e1f1d86db364d44f32e88e3b67e90bfe898c43aae05c0279e4d7f6f2981165bb40e2fb11b8c68c6f9fc574b02f57c4352cc53a540b749be56c5b22
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBwA+wt1:z6F0eMpAAYEhpwwhw3
TLSH
T15A456C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2580-153-0x0000000000400000-0x0000000000528000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads