6857b453eae51cdb2addea77ff5149c8329a5717af354888128f9097c8d96146

General

Target
2026-08-08_13b4228ec08639a6ce4cb03dd8333655_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260808-en5esshm3w
SHA256 6857b453eae51cdb2addea77ff5149c8329a5717af354888128f9097c8d96146
MD5 13b4228ec08639a6ce4cb03dd8333655
SHA1 1dfd1a271da0db855461149bc8a422ec5a86df4f
SHA512 21ed4ea606bf43f6269dd4daefc207a02a6da81f8eb0a6b0f8935f22c2bd961f225b56087d73f88173addd8b1f2ecdbaefe9e286e34725969972fcbcaf4a167d
SSDEEP 98304:L0nAAYEpTqUQA91pH2WpjHrgBFFu416AWv6:YNpqUQmHpn6F44IAWv6
TLSH
T1578628E56EA770ECE0AAD475B92A873EE6733C130031530B167FF6562E736242D19722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4168	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_13b4228ec08639a6ce4cb03dd8333655_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4168	4768	2026-08-08_13b4228ec08639a6ce4cb03dd8333655_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_13b4228ec08639a6ce4cb03dd8333655_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_13b4228ec08639a6ce4cb03dd8333655_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.3MB
SHA256 5d08584ed6080d3cbd45f1cb86aaddbfc3f0e868d9285a99a127108e67ad0e71
MD5 e421b4d00494b0b83c9bfe56d17e3594
SHA1 5766d7e82dcbed613f56502027a24025de60a931
SHA512 97f3777a2fcf0a0b5a8e3d3ee658db50ef2d96ad543e001f1d3880b78acf038b4832c368a5570bf84363b7bfd2017cac652b6b4dff0732aefe0ee9e965000b28
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHSq1783npi63ii:E6F0eMpAAYEhpSSqd8XpiML
TLSH
T101B54AD1BF92B0B0F4A30DB1391BE6BED5237C218C32895BB787FB1C6572651A529312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX678D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX678D.tmp
Size 1.9MB
SHA256 a180f6f6a561b2db08ba5ed082d26dbcdeadf573cc7e9249464a71e6a2a5713e
MD5 2fe57431eb047e825995b24b7303fd91
SHA1 8610c7f951cd964be7d0ca8cac5450a34d15baf2
SHA512 603619f21aa0f4de72f36b78311d3118911b8d10959899ca22e8f66e3effdf09d2257e9c96d6a5d2f161bbfd2c3a9e856d96c6910c1030dd30cf3898b6ea6114
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+SqT6:I6F0eMpAAYEhpTSqe
TLSH
T1759529E5FE42B0F4E8920CF1350BF7FED5236D2988228967F687FB28B5736216519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 c3abb47e4b3de9f75e6edb7fee977f80a4427397d5524491a4c56257aa3b439d
MD5 3fcb025c3d97872e46d9d6ee400cb369
SHA1 8f0562de64e590e2568f4e007c52754f3547908f
SHA512 f19afa229ead827d87a6136d7704b0fe64cbb671b602ab64b98dc81a553a5e3b1fb1043c264b758e6ae5894a8f996287d2c7e10b8917a9d7c9cd6bb2fa2b780f
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO7Sq23:o6F0eMpAAYEhpySqU
TLSH
T14F9539E5FE42B0F4E8920CF1350BF7FED5236D2988228967F687FB28B5736216519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 5f4483fd7370e00287508d3656493a035fdb0461191cd8bec57c4dade6ed793e
MD5 0398aa4b61de5fc8638d93fcaaaab991
SHA1 42f13c951171629e8534f881b1eb7e411047aa00
SHA512 a29324a801d6de380deb42fd2f5a7262ee8b8a2b4b28feb5945bb9f1909709d4e1b699354b6529592890a6d034c0d11e8e1360e06061465f81da4d7fb129c5ea
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOwSqfh:L6F0eMpAAYEhplSqp
TLSH
T1849529E5FE42B0F4E8920CF1350BF7FED5236D2988228967F687FB28B5736216519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 0761c0fce59429aab6314e54b49b5bd111bf0c07f19d78b3b7d03a81a5bf76ad
MD5 4eef771491a8694ea9ce27c11721238b
SHA1 fa82300407dfe36e33ca61fcfa08de09aefae9ca
SHA512 ee9c0fd4f342418016cb87bd7c2bbe40eb7ee44a932dbc745d80a05bfe2ea5a78b639c1b2a13f965443af16c6ed3a0315148d7f99fedbcdc15758a12f7b3450d
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODSqT6:86F0eMpAAYEhpeSqe
TLSH
T18E9529E5FE42B0F4E8920CF1350BF7FED5236D2988228967F687FB28B5736216519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 f5a1d548d4c8676ad831a1412cfd9a2b7a86c4798721cf7743d1bf2bed09303d
MD5 c7056d926c318758b1b119b91beb0995
SHA1 d755226067a7afa487b0991ecd5031dc551daad3
SHA512 0b7d2f97ff9a621e72b3a8087ae9e1c189ef46f1b0ffc7bb24783d3e0d5972e6169d40b9a47e0a8cc95869bdb5a882ef5e86f9a945f94fca5219accf3a443b67
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOiSq6k:I6F0eMpAAYEhpPSqf
TLSH
T1519539E5FE42B0F4E8920CF1350BF7FED5236D2988228967F687FB28B5736216519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4768-154-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads