967110dd7cf3e7b73ea49b688c543966ac8f53b609c3a422f78363c8b0799fc3

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_164de64cf5030a886b13f217ff78bea2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 4.1MB
Sample260819-afef7avvfx
SHA256 967110dd7cf3e7b73ea49b688c543966ac8f53b609c3a422f78363c8b0799fc3
MD5 164de64cf5030a886b13f217ff78bea2
SHA1 d81f040c34081f76f098becc7130a3ff1561cde0
SHA512 ae74083883435b5a4d7f1387da4752f70b4aa14075d3ad65d58b257185873459714c1249d4c8fbc9160ed57cee557ba4beae45630266483341bf63269db8cc0b
SSDEEP 49152:uzT2vOyCPO0oeW4SkZP4sz9MbkqJtb2IRpYqdYcLP:u1PO0UfkZck06sYcLP
TLSH
T176161801F2A54222D872E075CCDE6749EA3139602B3D87EB1606FAB86E337E1C576735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5364	5904	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_164de64cf5030a886b13f217ff78bea2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_164de64cf5030a886b13f217ff78bea2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_164de64cf5030a886b13f217ff78bea2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 256
  2⤵
  - Program crash
  PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5904 -ip 5904
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads