292eb559193c9c42cf9ff6649ca4eb09669f7f7d497ed92c93396f35422855fb

General

Target
2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.1MB
Sample260808-en7vxsbf64
SHA256 292eb559193c9c42cf9ff6649ca4eb09669f7f7d497ed92c93396f35422855fb
MD5 13b0b5424001bf5c7731e24cb71efd09
SHA1 d78d1f4fda50df127143521bcd2618c818955e1b
SHA512 71ab2bcd218ce31ce7da076e051422704b595e9d9c4d07870fcedd52bf8d73818389327cca2639185421e7ca850215342d1d773474558917f78eac161ef57106
SSDEEP 98304:v0nAAYEpKphvQA91pH2WpjHrgBFFu416AWvc:MNiQmHpn6F44IAWvc
TLSH
T102765CA5A2A760FDE4AFD075893AC732E6717C130031970F16BCDA562F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
1264	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1264	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1264	392	2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 bc3032a36b69836090ddad32ca83bef9ae1184f1c0cf7c90f38875ed04fcf8ec
MD5 c9d65151bc6a26f1463c9b62ee9f133b
SHA1 d7ecd3aca22b070cd068ab6ead8a27fcd256fa91
SHA512 69363328cfda1017d0d9dd268145389fe72acbfa0ce7af70cab7ce2e4fd60e0e576593b0890ee9a7a3a2f03608c21f8230e5a7990bf3e2baa0519946713ad37c
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOC+YYA+w0b83npi63iA:s6F0eMpAAYEhp1+phwu8XpiM1
TLSH
T14F756B50E7CAA8F0F97306B0497BE7B65630BD218431C92BE7C4EE0979B1952B539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6F6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6F6E.tmp
Size 1.2MB
SHA256 2f02b92e78c28c7e8d52fc854df87064bb213ee57b86fdb782e9edbb587cb313
MD5 0805e4e3f889d1d81821e41cb521b885
SHA1 1fb75ccfaeba5cd8331db7c67995a6e4edaff75d
SHA512 f4738001b8ca7f98a0d19d431b7dfa71b6174bc80f39cc4c816864d13702d852b8064ae9b5cec8e5a33286ed12e98458e1fdd400d99bd926af164d1d6df8a03a
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOL8+YYA+w03:U6F0eMpAAYEhpj+phwC
TLSH
T13F455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8EF01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7482.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7482.tmp
Size 1.2MB
SHA256 7b446f9b26c26d6893e8ad42222a97a198323ac3e86b1380459a9eef064f0635
MD5 ba3a086292e7e178197c7e520bf6e816
SHA1 b8a84a1b53cfd6c6e39978b7ac95324112044938
SHA512 d3034546d04ad78fdba32b11138e63feb978cd6112d12db03d9e9ee3cf5f9624e42e1697acfab89dd9c20d5ff06ff5d7c1536f0777f310ce0a0f8139fdced12a
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOP8+YYA+wlb:I6F0eMpAAYEhpz+phwN
TLSH
T17F455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8EF01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7492.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7492.tmp
Size 1.1MB
SHA256 d439bb9cc1013b156c5b94215228a13533d60dd94d876ed96d6a6d01021cb69b
MD5 ac0ff358a4990a63cbbe8df8b1ca1313
SHA1 59227b049347ec03c5fb2e5c5665896642d2931a
SHA512 a763f518025c52a5541dc1db07b5fb0199dce7342241445e0071c845cda88db2249a74cf740ddeeecdd7e5cdb9c597844185962aa9b6b4ff81b52d80f00a2e7b
SSDEEP 24576:+7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO0+YYA+w0T:16F0eMpAAYEhpD+phwm
TLSH
T18E455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8FE01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-267-0x0000000000400000-0x0000000000535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads