Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe
- Size 9.7MB
- Sample260821-ejqe3she66
- SHA256 7f279684700454c7bd3d4d98297e6186d3fe1175c13900db85a04059d455a6ba
- MD5 c00b6f37615e31db7f8b484fc7d0f144
- SHA1 bc108e13a33afeb30592c4c677d49916ecf307ad
- SHA512 110f8128b6d5cb01f879465bf3d4cf681c292aee1a50c51532eff376e03ccc2cbbb772fdc510a5543f1392ba6c6bd784c48484b830ad2b066065ddcb9c2242b9
- SSDEEP 98304:p33nLrHp/qKm2/Sb/gqAZj+UzKb3HtFPYjqw:VrRb/G8+HOqw
- TLSH T1C1A62613FBC51DD5F24900359E444630D72AE86996EB1362306CE1D9DF9F383AF29A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 63 IoCs
description ioc Process File created C:\Windows\Intelx386\Follada brutal coño roto.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Lolita Pack 20 Pics.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Download Accelerator Plus (DAP) (full version with serial).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\VirtualDub 2.1.4.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Mazinkaiser comics pack.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\FlashGet Max acceleration (Experimental).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\WinAce 3.85 (with Serial).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\ContaWin 2000 (full version).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Winamp 5.0 (full version).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\WAV2MP3.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Pedofilia pack 37 pics.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\a pelo.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\VMIntel386.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\RealOne Player (Full version).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Silent Hill.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Fuck my fat ass.avi.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Dont Touch.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Terminator 3 Wallpapers.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Hentai Evangelion Poker.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Matrix Wallpapers.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\PSEmu.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\3D Movie Maker.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\GBAEmu.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\No lo Descargues.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Winamp 3 (full version).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Winamp 3.5 (full version).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\GameCube Emulator.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Visual Studio (full).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\DivX 7.2 freeware.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Puta come mierda.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\3D Studio R8 (It's Work!!).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Hacha Profesional Edition.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\humor.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\BsPlayer v3.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\WinRar 4 (with crack).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\MSN messenger 6.3.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Pack Tonos y Logos para Nokia.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Resident Evil for GameCube.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Dont Download.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Solo para Maricas.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Update Photoshop 8.0 to Photoshop 9.5 (It´s Work!).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\RM2GBA.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Pack 50 Juegos PS2.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Visual C.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Sexo con una menor.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Hentai Shizuka clit.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Pack sex very hot nude young girl porn erotic private pussy rape clitoris suck chicas fotos culos tetas coños mamadas corridas sister hermana amigas friends lesbianas mujeres desnudas putas guarras hentai.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Juegos JAVA para NOKIA.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Pack 25 Juegos GameCube.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\German extreme violation.mpg.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Hentai.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Shinchan screen saver.scr 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\WinAmp skings and plugins.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\WinRar v6.11 (with crack).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Nero 7.5.1.0 (cracked!).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Simpsons pack guiones (Temporada 2004).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Mazinkaiser pack fondos de escritorio.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Capitulos ineditos de DragonBall Z jamas emitidos.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\mugen (full).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Chenoa en cueros.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Update Photoshop 7.0 to Photoshop 9.16 (It´s Work!).exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\WinZip 9.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe File created C:\Windows\Intelx386\Visual Basic 6.exe 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2272 4912 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_c00b6f37615e31db7f8b484fc7d0f144_elex_glassworm_icedid_njrat_rhadamanthys.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 2882⤵
- Program crash
PID:2272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4912 -ip 49121⤵PID:1464
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Intelx386\Update Photoshop 8.0 to Photoshop 9.5 (It´s Work!).exe
- Size 11.5MB
- SHA256 ea094ca79bb1469d1871eeed4c4ad0a46313f75a091cbb78965e2516606f6a79
- MD5 2464ac298c7a919a5e8774bb2e22bf96
- SHA1 810685a05fabce9cdafd69aab0fc0c3eae2b15dd
- SHA512 0c5c0341c8c786274da057fd4f0563a7fdaf684404ed486898ee1e45e953c71486c37eaddac161dc5133585c4724a743e4c4c73f21bbc776bc1de33ab56a6b8a
- SSDEEP 98304:p33nLrHp/qKm2/Sb/gqAZj+UzKb3HtFPYjqw:VrRb/G8+HOqw
- TLSH T109C62613FBC51DD5F24900359E444630D72AE86996EB1362306CE1D9DF9F383AF29A2B
- MD5 SHA1 SHA512 SSDEEP TLSH