292eb559193c9c42cf9ff6649ca4eb09669f7f7d497ed92c93396f35422855fb

General

Target
2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.1MB
Sample260808-en7vxsbf64
SHA256 292eb559193c9c42cf9ff6649ca4eb09669f7f7d497ed92c93396f35422855fb
MD5 13b0b5424001bf5c7731e24cb71efd09
SHA1 d78d1f4fda50df127143521bcd2618c818955e1b
SHA512 71ab2bcd218ce31ce7da076e051422704b595e9d9c4d07870fcedd52bf8d73818389327cca2639185421e7ca850215342d1d773474558917f78eac161ef57106
SSDEEP 98304:v0nAAYEpKphvQA91pH2WpjHrgBFFu416AWvc:MNiQmHpn6F44IAWvc
TLSH
T102765CA5A2A760FDE4AFD075893AC732E6717C130031970F16BCDA562F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5768	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5768	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 5768	5184	2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_13b0b5424001bf5c7731e24cb71efd09_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious use of SetWindowsHookEx
  PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX25B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX25B2.tmp
Size 1.1MB
SHA256 b246fe24484fbefe59e927ee7f21e739e904eb2423549f0055368224288fe259
MD5 98756639e26f7ec90b59a5413200e913
SHA1 79638112b3f57d8757a118ca44c746a713e4b02e
SHA512 c4d5f9d70c1cae6bf1be58dbf399ea0f29c4fcf151b3e489a98447dedf4fc8687962deecad4aff97e1cb1ce98b289f6c01fa8d5194b3e9d919d76a9150ffbbd8
SSDEEP 24576:m7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOO+YYA+wlP:d6F0eMpAAYEhpN+phwR
TLSH
T1E1455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8FE01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 2f02b92e78c28c7e8d52fc854df87064bb213ee57b86fdb782e9edbb587cb313
MD5 0805e4e3f889d1d81821e41cb521b885
SHA1 1fb75ccfaeba5cd8331db7c67995a6e4edaff75d
SHA512 f4738001b8ca7f98a0d19d431b7dfa71b6174bc80f39cc4c816864d13702d852b8064ae9b5cec8e5a33286ed12e98458e1fdd400d99bd926af164d1d6df8a03a
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOL8+YYA+w03:U6F0eMpAAYEhpj+phwC
TLSH
T13F455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8EF01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 539956d54cc1d9ac7fec1c73254b14cb2a89d29ddd6f8f2793948790d215ce00
MD5 ed20b08bdbe338a086042a7d6a938e57
SHA1 1bf0e3ca0fd289d6293d3a0d892b4872cc58e6a4
SHA512 f96058fef38a852cd55f1ebedc5922095d6596228ad186a5cb485889f7f1be98bfaf80b60793dc51525b8ce484e676ec0f589233e4640bd694362bb6f309c19e
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOy8+YYA+w/b:U6F0eMpAAYEhpY+phwD
TLSH
T1B3455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8EF01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7b446f9b26c26d6893e8ad42222a97a198323ac3e86b1380459a9eef064f0635
MD5 ba3a086292e7e178197c7e520bf6e816
SHA1 b8a84a1b53cfd6c6e39978b7ac95324112044938
SHA512 d3034546d04ad78fdba32b11138e63feb978cd6112d12db03d9e9ee3cf5f9624e42e1697acfab89dd9c20d5ff06ff5d7c1536f0777f310ce0a0f8139fdced12a
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOP8+YYA+wlb:I6F0eMpAAYEhpz+phwN
TLSH
T17F455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8EF01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 2a35c9b166806a0864e24cb01cd0d6cc66f5fe4c198081dba78aba3a2a72694b
MD5 5e30128093d8cd9ffafb13f13f600458
SHA1 18bade7e3e99ecab3c5a1f91aa5a6c177241d500
SHA512 b2908353a48f97068233cbc67f32e69ac16dd0ea6c1df40cbda69ac078d9de699ce16c9cf84b06aca8693eccbe4292faf786e05dc8c1cb3e8855e06ba7241bfd
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOq8+YYA+waE:E6F0eMpAAYEhpY+phwz
TLSH
T16F455B54E78BACF5E92310F0445BE7FBA5309E2540318D2BFBC8EF01BAB2D527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5184-152-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5184-157-0x0000000000400000-0x0000000000535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads