632ca8a411c03fbc53119bc292bd83e8a64f11c129f7c4ca25cdce61adca5430

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_be38a9964534c722a756d19dee2eb0d9_elex_glassworm_icedid_njrat_vidar.exe
Size 7.8MB
Sample260808-rkljqssvbx
SHA256 632ca8a411c03fbc53119bc292bd83e8a64f11c129f7c4ca25cdce61adca5430
MD5 be38a9964534c722a756d19dee2eb0d9
SHA1 f095cdf4e6905a0cdcbd69374eb8e0f78bd81362
SHA512 e74e9a9148852c9643e3b91dbdf77bb4a63b903deaa7d02162cebbdf3723c34ab40d8baa5c4ac4317f1acd132e39dcda732eccf3a8cde54d914c808a14ea6581
SSDEEP 98304:+0nAAYEpqhLu1MbQ9yDAD7KjjqkusjmqMh0:TN8u1tIDewjqkjiqMm
TLSH
T133867D39EBA4C1E5F9ABD878A97BC672FA717A110833530B89D1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1908	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_be38a9964534c722a756d19dee2eb0d9_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1908	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1908	3448	2026-08-08_be38a9964534c722a756d19dee2eb0d9_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_be38a9964534c722a756d19dee2eb0d9_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_be38a9964534c722a756d19dee2eb0d9_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX211C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX211C.tmp
Size 1.2MB
SHA256 4d5499221d3282339a1ad30b7105a7fe3fee75669f77f4307dd10ec21e3e099c
MD5 a7d18f50635d07104fd045cdd754e479
SHA1 4dcae67d6ee81a7efa167b2d62b56f7ab28fb2c4
SHA512 4bb5814f8d23fb24edba85055400bc697e16fb3b30a3503d9caa7e5975e06f57ccd050b8ac0595d97759707e1222bdefed50d1bd9a7ff0eb5f74d20742ad00b2
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3IYA+we9:X6F0eMpAAYEhpqhwO
TLSH
T1B6456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX23ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX23ED.tmp
Size 1.2MB
SHA256 7e3db334b234e19bdf2036824c550f3bdbd3a5dd78530bb492f0ef0660d3f684
MD5 cfa3e8641648286b55df5344904e382f
SHA1 33e13c42b0d5b2987f5cfae501d63f12e7443bf8
SHA512 fee9f4899de584b75a60e0284f93a1b932e84be32e6f65e6907e6fe59af3678a956e8eb7c477f842a105807b4eed48cfda1f879b9f01fef3307f9a6efdc7159c
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVIYA+wel:/6F0eMpAAYEhp8hwW
TLSH
T1F6456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 77f377f32f66ade9e42a9731dd7d83d4aad6a894515ddb22ec706b9e787c6859
MD5 f49a8b25fc26aca5ff9514efc75c7d3e
SHA1 1046179d447cf294382497b443dad22cb18e4c21
SHA512 bbd35a0fb85bfea82794e66112ec8edd0c130713f15dd3a06b64b49c814ef9d1c35fe4f2997e12c12f62e4ff81ad79d860c997345121d4dbf4f766b6135975e1
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQIYA+wrH:j6F0eMpAAYEhpthw7
TLSH
T18B456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 5f4a9ad07f780ca95418c65c49f8b22f56be6735f63165c975d2b2842573392d
MD5 12b19462f9a451ca3762e0f1dcc2799d
SHA1 fe27fed970ac45bc9450ff28c72469f50c741ded
SHA512 1601e8e68303479670e7bf2345bf4392f25028a8a6b5d19719189609a93938f307b31df8366bf89209a776fbcc378f9cc933f8ce543f237cb82501fd52e9d5f1
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObIYA+wsJ:/6F0eMpAAYEhpOhwE
TLSH
T150456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-153-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3448-155-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads