b2e44721bd34f846616a505afda98bf5c906ab995e6d4ec3eb4c53663410303d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
Size 6.5MB
Sample260809-yp7q4acc44
SHA256 b2e44721bd34f846616a505afda98bf5c906ab995e6d4ec3eb4c53663410303d
MD5 30966d8b47c0081ecadb7921ea333633
SHA1 2519774094403d39a162b28076156b4fdfb051c6
SHA512 33ed745dd10c4edacc660313ca761e03f2cfd3db3ee923ac66de605f79d220e6f6c921b4602f1da590eb7ad5005970e43f4e55004dc2a45c89c11cbe0a1900c8
SSDEEP 49152:ddRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTJJBSb:q/IJsiC5sop7cTJxoq2Vjnmq
TLSH
T11F664A556BB880F4E1A7D27889768A72F77678124F31ABDF0251C61E2F33AD04D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4756	temp0a1.exe

Executes dropped EXE 5 IoCs

pid	Process
4756	temp0a1.exe
2780	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
2388	winwin.exe
2532	temp0a1.exe
4932	winwin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\winwin.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winwin.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\file0a0.dat	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\winwin.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	winwin.exe
File opened for modification	C:\Windows\file0a0.dat	winwin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5452	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
5452	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
2388	winwin.exe
2388	winwin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 4756	5452	2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe	89
PID 4756 wrote to memory of 2780	4756	temp0a1.exe	90
PID 2388 wrote to memory of 2532	2388	winwin.exe	93
PID 2532 wrote to memory of 4932	2532	temp0a1.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2780

C:\Windows\winwin.exe
C:\Windows\winwin.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\winwin.exe
    C:\Windows\winwin.exe
    3⤵
    - Executes dropped EXE
    PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_30966d8b47c0081ecadb7921ea333633_elex_glassworm_icedid_njrat_vidar.exe
Size 4.1MB
SHA256 332eee2e0c6d24704b8c805b890f48e0b21be5c041e7147258ddd3dbc2d1ec92
MD5 e31bd41b3a0214d7f38724894d9a3b14
SHA1 26cbff072d79d1da7032584ae1aea21b6a4d8ec8
SHA512 8c07ec1ca52bae412781475ed8c7996a5ef00e1f5077b8c72a03f70f019654872caef85ef13c131fce371d30b0eb947d6981aab072914c86cd72bd1e47b1baa7
SSDEEP 49152:gdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbT4:L/IJsiC5sop7cT4
TLSH
T11C164B656BF880F5E1A7E134897AC9B2F77678420D31EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 115B
SHA256 6f1fe52ac4037b01724b7e4f8c1deab8257e670b1ba38079be0b915a4d2e23ad
MD5 d9ba43fef41bbef053aaa1b740582e62
SHA1 06b73f6d6b089e034c8f7227532b600f126d5716
SHA512 d73b32feb603d1db2c722a04083fcd3f7838b7710ac9a919215e1c4b16bf0d766b053c39d209f840474ceb8ac94dfdd3b0ce77e8f300c5532324e13758b7c785
TLSH
T1FBB092108AA78D890839700688A48A6EC5A26C4CBF251B60EBB5CC0E229654A7980611
MD5 SHA1 SHA512 TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 21B
SHA256 8b40f4451b27c9069370eb34567bdaae73afa9361291c1220aced1c4c5df4f86
MD5 bd234150f47b13cc2be0e469260f6e03
SHA1 2f176073737cfbafa05865e4157d371d4582290b
SHA512 fdb9d9369d583f373e29e8dd406ca4f63e905507e06cefb9edb589cab47ba6a9badf524074cfb9c1e606aa462baede3e632ab3be0f9dfe736079a72075948c60
MD5 SHA1 SHA512

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 6.5MB
SHA256 b2e44721bd34f846616a505afda98bf5c906ab995e6d4ec3eb4c53663410303d
MD5 30966d8b47c0081ecadb7921ea333633
SHA1 2519774094403d39a162b28076156b4fdfb051c6
SHA512 33ed745dd10c4edacc660313ca761e03f2cfd3db3ee923ac66de605f79d220e6f6c921b4602f1da590eb7ad5005970e43f4e55004dc2a45c89c11cbe0a1900c8
SSDEEP 49152:ddRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTJJBSb:q/IJsiC5sop7cTJxoq2Vjnmq
TLSH
T11F664A556BB880F4E1A7D27889768A72F77678124F31ABDF0251C61E2F33AD04D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winwin.exe

Path C:\Windows\winwin.exe
Size 2.4MB
SHA256 239246716a86658a32803b2f4876548b5541a95a2f52c753b074d21bd30887d8
MD5 5897e2643de7ae8dd05d554226425eb7
SHA1 b4b593b657e0e0a8a92607508d6db15b732dc846
SHA512 e76610693bdabc675d226bb8a529e32b94690d301c698db6c85a2266a322eda4eba9505dc886aebeb92198e8cb01fabf85ded7b86c50a1dfc22f40a87e61f9a8
SSDEEP 49152:NJBSU2CbRquA/m2yL5zbfFiV+XenmE3/zP:Nxoq2Vjnmq
TLSH
T11BC56C1A7AB8C1E4D1F6C77886A2C642F37178154B31A7EF5265460E1E33BE18E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winwin.exe

Path C:\Windows\winwin.exe
Size 257KB
SHA256 697a19f9cd2a4ab2825e87952590d893cfa0900c7977c513c66dccf752fe3858
MD5 fadaf60949bb571e54e414832c185ba8
SHA1 83df13c09e3a24e5a53f66916f7b0256c3beb391
SHA512 0b12f036ee6c0dffc5eab72b5e74d1a8b122e48fae4e12a757687221801258e5afd92ab0a331547afc9b1a92377d3615cf368d79d215b59d00cc7a1fa9c0f4ab
SSDEEP 3072:wF/ZYtu9FYZSFAk9O6UEBOtNU6ITLTkjpQyzwo8FO71OhgUE6PjFv:wRZgyST56ROtNU6ITLTkVd4QOhgUE67l
TLSH
T16244D53BEE38FCD1C67A8DB95A91C640D7B275704B52A3CBD174820E8E136E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-15-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2532-21-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4756-12-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5452-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download