9157d5b1f5ee10f17793cd873e43c32663604e1c52cabb4fa3c9be9deabe8ad5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_608131f398cb9400a34c4a4021e12072_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 6.7MB
Sample260818-sd7daswsdt
SHA256 9157d5b1f5ee10f17793cd873e43c32663604e1c52cabb4fa3c9be9deabe8ad5
MD5 608131f398cb9400a34c4a4021e12072
SHA1 482870010c36ee69097a69eace195c6dbf36f125
SHA512 e770ce416be9ca5a0dc2cb21f01ee0fe34606b922bd1c092ee2c231aaf4231b5b73deb2ef7228f3977f276c6cc6b7c2be89897ef72dae71a88588b64807eefa5
SSDEEP 49152:U+EN+ES+EN+ES+EN+ES+EN+ES+ErMb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiuc:pA91pH2WpjHrgBFFu416AWvc
TLSH
T116665AA5A1A720FDE0AFE079897AC732E6B17C130131934F167CD6562F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	1464	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_608131f398cb9400a34c4a4021e12072_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_608131f398cb9400a34c4a4021e12072_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_608131f398cb9400a34c4a4021e12072_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 256
  2⤵
  - Program crash
  PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1464 -ip 1464
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads