53b5096e7c66718546bdf663817abc886d1fdf0823f53c3fc89f58e378905b01

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_b377e48a7c1332351a4295290e48f959_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.1MB
Sample260908-jta6csvfjh
SHA256 53b5096e7c66718546bdf663817abc886d1fdf0823f53c3fc89f58e378905b01
MD5 b377e48a7c1332351a4295290e48f959
SHA1 b7caf255927a5c272481945b985591ab40ed0d4c
SHA512 683e0466c0534daaf2056042f6ba94d6cb21601bcb3c4bd4ade46ec8740d0fe0f392c3cde08e57ee727a1a810cfc0ba41df44630aeea0192c739d8e4340f8049
SSDEEP 98304:b0nAAYEpJzhdQA91pH2WpjHrgBFFu416AWv0:INfvQmHpn6F44IAWv0
TLSH
T13C766CA5A2A760FDE4AFD075892AC732E6717C130031970F16BCDA563F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4808	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_b377e48a7c1332351a4295290e48f959_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4808	2424	2026-09-07_b377e48a7c1332351a4295290e48f959_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-07_b377e48a7c1332351a4295290e48f959_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_b377e48a7c1332351a4295290e48f959_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX14C7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX14C7.tmp
Size 1.1MB
SHA256 c19e9ad54209e58ea12a294a9e136d475dacfd2941a1e5c62e51d3be633a4723
MD5 c828347d42bfc8f2dc0d40e987ebb72d
SHA1 684342c221d61470761a89093f56582414e281a4
SHA512 e3c6568f9d7ca20bff1c285c7607de26350c600a4303235831f3b5f0ed9ab1d5a1423991d4246450c471cf0500bb2215249f0a0d4dc9111425c96cbfdf74b13b
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6BIYA+wwt:46F0eMpAAYEhpJzhwA
TLSH
T12F455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 8192e6c044b2d177ad21bade2943525618b2c7e6244b0546c0d5bb8691f43b49
MD5 4ef63dce78966d4eef7a92b3d39f226e
SHA1 ce5a6e160c9152ee38602f7774d7f78d3dedac5e
SHA512 c94093a52889627661a4c5416c683a2e774f36579b4678e7afc87124779980d8a7cce618953017bad2846aa1e8c79d6854deb21ec916ba3447b387ab136f2896
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9BIYA+w5t:86F0eMpAAYEhp+zhwT
TLSH
T19E455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 bcc40f6f87c45013932354e26656dfe505e2236c6a2860b93746aad0e5ad282a
MD5 73edc33d338aad15e1713203512678fa
SHA1 b41f09602b7b474d4df9642edcf0aa8c9c80ca04
SHA512 5b004ebd67c062516e4fae5f1d62e71f92bd1ffcf2bd589d5dfe478315fc711678c37ca6f40f55ef3b2c6c72c8aa2b5626dbbfa6cd4444d6225f56c27f03b345
SSDEEP 24576:K7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVBIYA+wk7:Z6F0eMpAAYEhpmzhwe
TLSH
T145455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2424-152-0x0000000000400000-0x0000000000531000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads